CVE-2026-98950 Affecting kernel-livepatch-6.12.113-138.209 package, versions <1:1.0-0.amzn2023
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-AMZN2023-KERNELLIVEPATCH612113138209-21810590
- published29 Oct 2026
- disclosed23 Oct 2026
Introduced: 23 Oct 2026
NewCVE-2026-98950 (opens in a new tab)How to fix?
Upgrade Amazon-Linux:2023 kernel-livepatch-6.12.113-138.209 to version 1:1.0-0.amzn2023 or higher.
This issue was patched in ALAS2023-2026-3335.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-livepatch-6.12.113-138.209 package and not the kernel-livepatch-6.12.113-138.209 package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2023 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()
bpf_flow_dissect() sanitizes the offsets returned by the BPF program with clamp_t(u16, ..., hlen).
If hlen is bigger than 65535, the upper bound is truncated before the comparison. For instance, with hlen == 65536, both nhoff and thoff are forced to zero, even if the program returned sane values.
This is the same class of bug as the one fixed in commit 99bda1ecbd56 ("flow_dissector: avoid u16 truncation of skb->len when computing thoff"). That fix does not cover the BPF path, because __skb_flow_dissect() returns early when a BPF flow dissector handles the packet.
struct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen to U16_MAX before clamping.
Found by sashiko while reviewing the commit above.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-98950
- https://git.kernel.org/stable/c/3fb5ad2951a6df92c98f4f06cd70f20c50a2eb2a
- https://git.kernel.org/stable/c/61b43a51a55929ec040bee3ea51af2121b956d05
- https://git.kernel.org/stable/c/c44c02c930c6583b235a1937c69ff716c4bb4514
- https://git.kernel.org/stable/c/cc18eb0e9941162c03f03f411ed7f6c339d91fa0
- https://git.kernel.org/stable/c/f202578efc738b883cfa04889eb97328914265a7