In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead… (CVE-2026-98572)

The Linux kernel's BPF subsystem on MIPS32 had a vulnerability where the immediate jump instructions JEQ/JNE emitted an addu instruction instead of addiu. This caused the immediate value 1 to be interpreted as the register $at (mapped to BPF_REG_AX), invalidating comparisons when the immediate operand was negative. This flaw impacted the correctness of constant blinding in BPF programs. The issue was detected using test_bpf on MIPS32r1 emulated by QEMU and has been fixed by correcting the instruction to use the immediate form.

The vulnerability caused invalid comparison results in BPF programs on MIPS32 architectures when using immediate jump instructions with negative operands. This could affect the behavior of BPF programs relying on constant blinding, potentially leading to incorrect program logic or bypass of intended checks. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to correct the instruction emitted for immediate JMP JEQ/JNE on MIPS32, replacing addu with addiu. Users should update to the fixed kernel version containing this patch. No additional mitigation steps are indicated.