In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an… (CVE-2026-98856)

The vulnerability in the Linux kernel's kprobes on x86 arises from the handling of optimized probes (optkprobes) that replace five bytes with a jump instruction. If a disabled probe exists within the jump range of an active optimized probe, the function get_optimized_kprobe() prematurely stops when it encounters the disabled probe while attempting to arm a new probe. This results in the last byte of the jump displacement being overwritten by the new probe's INT3 instruction, causing execution to jump to an incorrect address. The fix involves skipping disarmed and unprepared probes to correctly identify the active optimized probe before arming a new one.

The flaw could cause the processor to jump to an incorrect address during execution of kprobes, potentially leading to unpredictable kernel behavior or instability. However, no known exploits are reported in the wild. The impact is limited to kernel-level probe handling on x86 architectures.

A fix has been implemented in the Linux kernel to address this issue by skipping disarmed probes when checking for optimized kprobe overlaps. Users should apply the official kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.