CVE-2026-98041

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't predict JMP32 pointer vs zero comparisons

Consider the following program:

r1 = map_value; /* low 32 bits are zero at runtime */

r6 = 0xdead000000000000;

if w1 != 0 goto l1;

l0: r1 += r6;

r2 = *(u64 *)(r1 + 0);

exit;

l1: r6 = 0;

goto l0;

At the moment is_branch_taken() reports the jump as always taken,

because it does not distinguish between BPF_JMP and BPF_JMP32

comparisons when processing 'if w1 != 0 ...'.