{"id":"CVE-2026-68295","state":"PUBLISHED","title":"LoongArch: BPF: Zero-extend signed ALU32 div/mod results","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Zero-extend signed ALU32 div/mod results\n\nALU32 operations write a 32-bit result and leave the upper 32 bits of\nthe BPF register zero. The LoongArch JIT sign-extends the result of\nsigned ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient\nor remainder leaves bits 63:32 set in JITted code while the verifier\nand interpreter model those bits as zero.\n\nKeep sign-extension on the operands, which signed divide needs, and\nzero-extend the ALU32 result after the divide or modulo instruction,\nmatching the unsigned ALU32 div/mod paths and every other ALU32\noperation in this JIT.","publishedAt":"2026-08-10T12:02:28.412Z","updatedAt":"2026-10-21T12:43:47.769Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"7577cca85f2d4590c9d9423ba72ef54181a713c9","versionType":"git"},{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"16656c3d734693be3d8a36dbf9d09142b69f3ddc","versionType":"git"},{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"716cb29dbed4d62e9e108950a1a82bcba4cc2d45","versionType":"git"},{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"dacd348b8a993373576fe2ee2d8b114740ba57a6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/net/bpf_jit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/net/bpf_jit.c"]}],"references":["https://git.kernel.org/stable/c/7577cca85f2d4590c9d9423ba72ef54181a713c9","https://git.kernel.org/stable/c/16656c3d734693be3d8a36dbf9d09142b69f3ddc","https://git.kernel.org/stable/c/716cb29dbed4d62e9e108950a1a82bcba4cc2d45","https://git.kernel.org/stable/c/dacd348b8a993373576fe2ee2d8b114740ba57a6"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68295.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68295","state":"PUBLISHED","datePublished":"2026-08-10T12:02:28.412Z","dateUpdated":"2026-10-21T12:43:47.769Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.380Z"},"containers":{"cna":{"title":"LoongArch: BPF: Zero-extend signed ALU32 div/mod results","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nLoongArch: BPF: Zero-extend signed ALU32 div/mod results\n\nALU32 operations write a 32-bit result and leave the upper 32 bits of\nthe BPF register zero. The LoongArch JIT sign-extends the result of\nsigned ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient\nor remainder leaves bits 63:32 set in JITted code while the verifier\nand interpreter model those bits as zero.\n\nKeep sign-extension on the operands, which signed divide needs, and\nzero-extend the ALU32 result after the divide or modulo instruction,\nmatching the unsigned ALU32 div/mod paths and every other ALU32\noperation in this JIT."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"7577cca85f2d4590c9d9423ba72ef54181a713c9","versionType":"git"},{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"16656c3d734693be3d8a36dbf9d09142b69f3ddc","versionType":"git"},{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"716cb29dbed4d62e9e108950a1a82bcba4cc2d45","versionType":"git"},{"version":"2425c9e002d2a1fdca34261b2fa6713eafef2163","status":"affected","lessThan":"dacd348b8a993373576fe2ee2d8b114740ba57a6","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/net/bpf_jit.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.7","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.7","versionType":"semver"},{"version":"6.12.114","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["arch/loongarch/net/bpf_jit.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/7577cca85f2d4590c9d9423ba72ef54181a713c9"},{"url":"https://git.kernel.org/stable/c/16656c3d734693be3d8a36dbf9d09142b69f3ddc"},{"url":"https://git.kernel.org/stable/c/716cb29dbed4d62e9e108950a1a82bcba4cc2d45"},{"url":"https://git.kernel.org/stable/c/dacd348b8a993373576fe2ee2d8b114740ba57a6"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The flaw is in the LoongArch eBPF JIT and is reached by loading a BPF program via the bpf(BPF_PROG_LOAD) syscall, which requires local access to the system. No network-facing path emits JITted signed ALU32 div/mod on behalf of a remote peer.\nAC:L - The attacker fully controls the BPF instruction sequence and the divisor/dividend, so producing a negative signed ALU32 quotient or remainder is deterministic and repeatable with no race, timing, or memory-layout dependency.\nPR:L - Loading an eBPF program requires only an unprivileged local user where unprivileged BPF is permitted, or CAP_BPF/CAP_SYS_ADMIN which is reachable via user namespaces on many deployments; no real root in the init namespace is needed.\nUI:N - The attacker loads and runs its own BPF program; no action by any other user or administrator is required at any point.\nS:U - The verifier bypass and resulting memory corruption stay within the kernel's own security authority on the same host, giving kernel-level privilege escalation rather than crossing a VM, IOMMU, or hypervisor boundary.\nC:H - The verifier models bits 63:32 of the ALU32 result as zero while the JIT leaves them set, so a later ALU64 shift lets the verifier conclude a register is constant zero when it is really 0xFFFFFFFF; using it as a pointer offset yields an attacker-controlled out-of-bounds read of arbitrary kernel memory.\nI:H - The same verifier/JIT range mismatch produces an out-of-bounds pointer that passes verification for stores as well as loads, giving an arbitrary kernel write primitive usable for control-flow hijacking and full privilege escalation.\nA:H - Out-of-bounds accesses through the mis-tracked register readily fault on unmapped or protected kernel addresses, causing an oops or panic, and the corruption can be repeated at will to bring the system down."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-21T12:43:47.769Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.114"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}