In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before bpf_opt_subreg_zext_lo32_rnd_hi32(). That pass emits an explicit zero extension for a 32-bit cmpxchg even when bpf_jit_needs_zext() is false. This is done because on some architectures 32-bit cmpxchg requires explicit zero extension for the dst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax if comparison is successful, while BPF semantics declare that each operation on a 32-bit register zero extends it's upper half. is_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena cmpxchg misses said zero extension adjustment. This patch adjusts is_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an
    arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX |
    BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before bpf_opt_subreg_zext_lo32_rnd_hi32(). That
    pass emits an explicit zero extension for a 32-bit cmpxchg even when bpf_jit_needs_zext() is false. This
    is done because on some architectures 32-bit cmpxchg requires explicit zero extension for the dst
    register. E.g. on x86-64 'lock cmpxchg' does not change the %eax if comparison is successful, while BPF
    semantics declare that each operation on a 32-bit register zero extends it's upper half. is_cmpxchg_insn()
    matches BPF_MODE == BPF_ATOMIC only, so an arena cmpxchg misses said zero extension adjustment. This patch
    adjusts is_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside BPF_ATOMIC. (CVE-2026-98049)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: zero extend the result of an arena 32-bit cmpxchg bpf_convert_ctx_accesses() rewrites an atomic on an     arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before     bpf_opt_subreg_zext_lo32_rnd_hi32(). That pass emits an explicit zero extension for a 32-bit cmpxchg even     when bpf_jit_needs_zext() is false. This is done because on some architectures 32-bit cmpxchg requires     explicit zero extension for the dst register. E.g. on x86-64 'lock cmpxchg' does not change the %eax if     comparison is successful, while BPF semantics declare that each operation on a 32-bit register zero     extends it's upper half. is_cmpxchg_insn() matches BPF_MODE == BPF_ATOMIC only, so an arena cmpxchg misses     said zero extension adjustment. This patch adjusts is_cmpxchg_insn() to match BPF_PROBE_ATOMIC alongside     BPF_ATOMIC. (CVE-2026-98049)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
474663	Chainguard: linux-desktop-7.2-bootc: security update to 7.2.7-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
474663	Chainguard: linux-desktop-7.2-bootc: security update to 7.2.7-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
350625	Linux Distros Unpatched Vulnerability : CVE-2026-98049	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-98049

medium

Tenable Plugins

high

medium

medium

medium