CVE-2026-98049

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When executing a 32-bit atomic compare-and-exchange operation on arena memory, the kernel fails to properly clear (zero-extend) the upper half of the target register as required by BPF specifications. A local attacker with permission to load BPF programs could exploit this register state discrepancy to cause memory corruption, potentially leading to privilege escalation or a denial of service (system crash).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.