CVE-2026-98572 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of MIPS32 architectures who utilize BPF-based applications or services, should review and apply the patch to ensure correct instruction emission for BPF bytecode execution on MIPS32 architectures. Additionally, operators and security teams responsible for managing and securing Linux kernel deployments should be aware of this vulnerability and take necessary actions to verify and mitigate potential 3

Why it matters

A vulnerability in the Linux kernel has been resolved, which could potentially impact the execution of BPF bytecode on MIPS32 architectures. The issue arises from an incorrect instruction emission, specifically an 'addu' instruction instead of 'addiu', leading to misinterpretation of immediate values when they are negative. Linux kernel developers and maintainers should review and apply the patch to ensure correct instruction emission for BPF bytecode execution on MIPS32 architectures.

• Verification of BPF bytecode execution on MIPS32 architectures is required to ensure correct behavior.
• Potential misinterpretation of immediate values could lead to incorrect results or crashes in BPF-related activities.

Technical summary

The vulnerability arises from an incorrect instruction emission in the Linux kernel, specifically an 'addu' instruction instead of 'addiu', leading to misinterpretation of immediate values when they are negative. This affects BPF bytecode execution on MIPS32 architectures. The fix involves correcting the instruction to use the immediate form, ensuring that immediate values are interpreted correctly and preventing potential misinterpretation that could lead to incorrect results or crashes in BPF-related activities. Linux kernel developers and maintainers should review and apply the patch to ensure correct instruction emission for BPF bytecode execution on MIPS32 architectures.

Defensive priority

Low

Recommended defensive actions

• Review and apply the patch to ensure the correct instruction emission for BPF bytecode execution on MIPS32 architectures.
• Verify the Linux kernel version and configuration to determine if the system is affected.
• Monitor for any potential exploitation attempts or anomalies in BPF-related activities.
• Perform a thorough review of BPF-related activities and configurations to identify potential vulnerabilities.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was found using test_bpf on MIPS32r1 emulated by QEMU. The issue has been fixed by correcting the instruction to use the immediate form. The fix ensures that immediate values are interpreted correctly, preventing potential misinterpretation that could lead to incorrect results or crashes in BPF-related activities. Verification of BPF bytecode execution on MIPS32 architectures is required to ensure correct behavior.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.