Linux Kernel CVE-2026-68295

The LoongArch JIT compiler (arch/loongarch/net/bpf_jit.c) is responsible for translating BPF bytecode to native LoongArch machine instructions. In the BPF execution model, ALU32 operations must produce a 32-bit result with the upper 32 bits of the 64-bit register zeroed - this is a hard architectural invariant that the verifier enforces statically. The bug lies specifically in the signed variants of BPF_DIV and BPF_MOD (off=1 flag selects signed semantics): the JIT correctly sign-extends the operands before the division (required for LoongArch signed-divide semantics) but then fails to zero-extend the 32-bit result afterward, as every other ALU32 operation in the same JIT does. The result is that a negative quotient or remainder leaves bits 63:32 set to 0xFFFFFFFF in JIT-executed code, while the verifier and interpreter both model those bits as zero. This creates a semantic divergence - the JIT produces register state the verifier never verified - which is the classical precondition for eBPF sandbox escapes. CPE data (cpe:2.3:a:linux:linux) confirms the Linux kernel as the affected product. No CWE is assigned, but this maps to CWE-682 (Incorrect Calculation) combined with CWE-193 (Off-by-one Error in sign/zero extension handling).