{"id":"AZL-109202","summary":"CVE-2026-98572 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix immediate JMP JEQ/JNE on MIPS32\n\nAn addu instruction was emitted instead of addiu, causing the immediate\nvalue 1 to be interpreted as register $at. This made the comparison\nresult invalid when the immediate operand was negative. Note that $at\nis mapped to BPF_REG_AX, which is used for constant blinding.\n\nFix the instruction to use the immediate form.\n\nFound with test_bpf on MIPS32r1 emulated by QEMU.","modified":"2026-10-19T14:16:31.676659023Z","published":"2026-10-18T16:17:09Z","upstream":["CVE-2026-98572"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98572"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-109202.json"}}],"schema_version":"1.9.0"}