LoongArch: BPF: Zero-extend signed ALU32 div/mod results (CVE-2026-68295) | HOL Guard CVE

High · CVSS 7.8CVE-2026-68295

LoongArch: BPF: Zero-extend signed ALU32 div/mod results

Answer in brief

CVE-2026-68295 records a High severity (CVSS 7.8) vulnerability in LoongArch: BPF: Zero-extend signed ALU32 div/mod results. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 10, 2026Updated Aug 17, 2026Source checked Sep 24, 2026First seen by HOL Aug 10, 2026Material review Aug 17, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.8
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=2425c9e002d2a1fdca34261b2fa6713eafef2163 <716cb29dbed4d62e9e108950a1a82bcba4cc2d45 \|\| >=2425c9e002d2a1fdca34261b2fa6713eafef2163 <dacd348b8a993373576fe2ee2d8b114740ba57a6	716cb29dbed4d62e9e108950a1a82bcba4cc2d45, dacd348b8a993373576fe2ee2d8b114740ba57a6
Linux/Linuxgeneric	6.7	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 716cb29dbed4d62e9e108950a1a82bcba4cc2d45 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 10, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient or remainder leaves bits 63:32 set in JITted code while the verifier and interpreter model those bits as zero. Keep sign-extension on the operands, which signed divide needs, and zero-extend the ALU32 result after the divide or modulo instruction, matching the unsigned ALU32 div/mod paths and every other ALU32 operation in this JIT.

Quoted source text, attributed separately from HOL analysis.