LoongArch: BPF: Zero-extend signed ALU32 div/mod results
CVE-2026-68295 · published 10 Aug 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-68295?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 2425c9e002d2a1fdca34261b2fa6713eafef2163 to < 7577cca85f2d4590c9d9423ba72ef54181a713c9, 2425c9e002d2a1fdca34261b2fa6713eafef2163 to < 16656c3d734693be3d8a36dbf9d09142b69f3ddc, 2425c9e002d2a1fdca34261b2fa6713eafef2163 to < 716cb29dbed4d62e9e108950a1a82bcba4cc2d45, 2425c9e002d2a1fdca34261b2fa6713eafef2163 to < dacd348b8a993373576fe2ee2d8b114740ba57a6
- Linux Linux: 6.7
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
LoongArch: BPF: Zero-extend signed ALU32 div/mod results
ALU32 operations write a 32-bit result and leave the upper 32 bits of
the BPF register zero. The LoongArch JIT sign-extends the result of
signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient
or remainder leaves bits 63:32 set in JITted code while the verifier
and interpreter model those bits as zero.
Keep sign-extension on the operands, which signed divide needs, and
zero-extend the ALU32 result after the divide or modulo instruction,
matching the unsigned ALU32 div/mod paths and every other ALU32
operation in this JIT.
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/7577cca85f2d4590c9d9423ba72ef54181a713c9
- git.kernel.org/stable/c/16656c3d734693be3d8a36dbf9d09142b69f3ddc
- git.kernel.org/stable/c/716cb29dbed4d62e9e108950a1a82bcba4cc2d45
- git.kernel.org/stable/c/dacd348b8a993373576fe2ee2d8b114740ba57a6
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON