Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Azure kernel 6.6.157.1-1 may misjudge program flow
published 1 month ago
Summary
The Linux kernel version 6.6.157.1-1 used in Azure can incorrectly decide that a certain code branch will always run, even when it shouldn't. This could allow crafted programs to behave unexpectedly, potentially leading to system instability. Update the kernel to the latest patched version to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | kernel | <= 6.6.157.1-1 |
Original advisory text
CVE-2026-98041 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't predict JMP32 pointer vs zero comparisons
Consider the following program:
r1 = map_value; /* low 32 bits are zero at runtime */
r6 = 0xdead000000000000;
if w1 != 0 goto l1;
l0: r1 += r6;
r2 = *(u64 *)(r1 + 0);
exit;
l1: r6 = 0;
goto l0;
At the moment is_branch_taken() reports the jump as always taken,
because it does not distinguish between BPF_JMP and BPF_JMP32
comparisons when processing 'if w1 != 0 ...'.
bpf: Don't predict JMP32 pointer vs zero comparisons
Consider the following program:
r1 = map_value; /* low 32 bits are zero at runtime */
r6 = 0xdead000000000000;
if w1 != 0 goto l1;
l0: r1 += r6;
r2 = *(u64 *)(r1 + 0);
exit;
l1: r6 = 0;
goto l0;
At the moment is_branch_taken() reports the jump as always taken,
because it does not distinguish between BPF_JMP and BPF_JMP32
comparisons when processing 'if w1 != 0 ...'.
References
Timeline
Published25 Sep 2026
Updated26 Sep 2026
First seen26 Sep 2026
Sources
AZL-104495 · OSV
Track software like this
Free during beta