{"id":"AZL-108740","summary":"CVE-2026-98631 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxsk: Use a 32-bit compare in xsk_map_gen_lookup\n\nxsk_map_gen_lookup() loads a u32 key and compares it with max_entries\nusing BPF_JMP_IMM. BPF immediates are sign-extended to 64 bits, so a\nmax_entries value of 0x80000000 or higher becomes a threshold larger\nthan every zero-extended 32-bit key. An out-of-range index then skips\nthe bounds check and the generated lookup reads past xsk_map[].\n\nCompare with BPF_JMP32_IMM so the check stays in 32-bit unsigned range.","modified":"2026-10-19T14:16:49.067553756Z","published":"2026-10-18T16:17:16Z","upstream":["CVE-2026-98631"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98631"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-108740.json"}}],"schema_version":"1.9.0"}