CVE-2026-98588

Received Received - Intake

Linux Kernel BPF Sockmap Integer Overflow Vulnerability

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sock_map_alloc() only rejects max_entries == 0 and otherwise allows any u32 value. sock_map_free() then walks the sks[] array with a signed int iterator: int i; for (i = 0; i < stab->map.max_entries; i++) struct sock **psk = &stab->sks[i]; When a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the allocation of 32 GiB can succeed on large-memory hosts. During free the counter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq and turned into a ~16 GiB negative offset from stab->sks, pointing far below the allocation. The faulting access is an xchg() write in sock_map_free(). Without KASAN, the same out-of-bounds write can fault on an unmapped vmalloc page or corrupt an unrelated allocation if that vmalloc address is populated. On a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that address hits an unmapped shadow page and oopses first: BUG: unable to handle page fault for address: fffff521b59c5a00 RIP: 0010:kasan_check_range+0x107/0x190 Call Trace: sock_map_free+0x93/0x190 map_create+0x68d/0xb30 __sys_bpf+0x21e/0x2e70 Vmcore confirmed stab->map.max_entries == 0xffffffff, stab->sks == 0xffffc911ace2d000, and the faulting address sks + (s64)INT_MIN * 8 exactly at 0xffffc90dace2d000. The same buggy path is reached on the normal close()/bpf_map_free_deferred() path whenever such a map is destroyed. sock_map_alloc() used to bound its allocation size through bpf_map_charge_init(), but the bound was dropped when rlimit-based memory accounting was removed. Reject max_entries > INT_MAX at creation time so the signed iterator in sock_map_free() never sees a value that would overflow. Triggered by syzkaller and reproduced on both a 6.6-based KASAN kernel and the upstream v7.3-rc2 kernel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98588

EUVD

EUVD-2026-103633

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	0d2c4f9640501ff57ba0be1f5644a02c29a02fa1
Linux	Linux	5.11

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) sockmap functionality. It occurs when a SOCKMAP is created with max_entries set to UINT_MAX (0xffffffff). The allocation may succeed on large-memory hosts, but during cleanup, a signed integer overflow causes an out-of-bounds memory access. This leads to memory corruption or crashes, especially when KASAN is enabled.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF sockmap functionality and requires kernel-level inspection. Check if your kernel version is affected by examining the BPF sockmap code for the described issue. Use commands like 'uname -a' to check kernel version and 'dmesg | grep sockmap' to look for related errors. If you suspect exploitation, inspect BPF maps with 'bpftool map show' and check for unusually large max_entries values.

Impact Analysis

If exploited, this flaw could allow an attacker to crash the system, corrupt memory, or potentially execute arbitrary code with kernel privileges. It may also enable denial-of-service conditions or privilege escalation on affected Linux systems using BPF sockmap features.

Compliance Impact

This vulnerability in the Linux kernel's BPF sockmap could potentially lead to memory corruption or out-of-bounds writes, which may result in unauthorized data access or system instability. Such issues could violate compliance requirements under GDPR (data protection) or HIPAA (healthcare data security) by compromising data integrity or confidentiality if exploited.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this sockmap vulnerability. If immediate patching is not possible, consider disabling BPF sockmap functionality by setting 'bpf_jit_enable=0' in kernel parameters or restricting BPF usage via seccomp profiles. Monitor for suspicious activity in BPF maps and kernel logs.

Hi! I’m here to help you understand CVE-2026-98588. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70