Linux Kernel eBPF Vulnerability Rated 7.8 CVSS

Last refreshed2026-10-15

Status: UPDATED | Advisory ID: CVE-2026-68295

Key Details

CVE	CVE-2026-68295
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-15
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Exploitation prediction (EPSS)	0.17% probability of exploitation in the next 30 days (5% percentile) -- FIRST.org's EPSS model.

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Zero-extend signed ALU32 div/mod results

ALU32 operations write a 32-bit result and leave the upper 32 bits of

the BPF register zero. The LoongArch JIT sign-extends the result of

signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient

or remainder leaves bits 63:32 set in JITted code while the verifier

and interpreter model those bits as zero.

Keep sign-extension on the operands, which signed divide needs, and

zero-extend the ALU32 result after the divide or modulo instruction,

matching the unsigned ALU32 div/mod paths and every other ALU32

operation in this JIT. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-68295
CVE	https://www.cve.org/CVERecord?id=CVE-2026-68295

Source

Reference

NVD

CVE