In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk_map_gen_lookup xsk_map_gen_lookup() loads a u32… (CVE-2026-98631)

The Linux kernel's xsk_map_gen_lookup function loaded a 32-bit key and compared it with max_entries using BPF_JMP_IMM, which sign-extends immediates to 64 bits. When max_entries was 0x80000000 or higher, the threshold became larger than any zero-extended 32-bit key, causing the bounds check to be skipped. This resulted in an out-of-range index and a read beyond the xsk_map array. The vulnerability was fixed by switching the comparison to BPF_JMP32_IMM, ensuring the check remains within the 32-bit unsigned range.

The vulnerability could lead to out-of-bounds reads in kernel memory due to improper bounds checking in the xsk_map_gen_lookup function. This could potentially cause information disclosure or kernel instability. No known exploits in the wild have been reported.

A fix has been applied to the Linux kernel to use a 32-bit unsigned comparison (BPF_JMP32_IMM) in xsk_map_gen_lookup, preventing out-of-range index access. Users should update to the patched kernel version once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.