{"id":"AZL-108740","summary":"CVE-2026-98631 affecting package kernel for versions less than 6.6.159.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold larger\nthan every zero-extended 32-bit key. An out-of-range index then skips\nthe bounds check and the generated lookup reads past xsk_map[].\n\nCompare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.","modified":"2026-11-02T14:17:51.836742611Z","published":"2026-10-18T16:17:16Z","upstream":["CVE-2026-98631"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98631"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.6.159.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108740.json"}}],"schema_version":"1.9.2"}