CVE-2026-98039
Received Received - Intake

Memory Corruption in Linux Kernel BPF Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEM_PERCPU for percpu kptr stores map_kptr_match_type() treats perm_flags as the set of register type flags that a kptr field permits. Adding MEM_PERCPU to that set for BPF_KPTR_PERCPU does not require the source register to carry it, however. The subset test consequently accepts both a plain bpf_obj_new() allocation and a referenced kernel pointer into a __percpu_kptr map field. Loads from the field are always marked MEM_PERCPU. Consumers then treat the stored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer helpers relocate it, and map teardown selects the per-CPU free path. A plain allocation can therefore provide an arbitrary kernel read/write, while a kernel pointer can be relocated into an invalid address or sent through a missing destructor. Require the source MEM_PERCPU flag to match the destination field kind. This preserves valid bpf_percpu_obj_new() stores and rejects both the program-BTF and kernel-BTF variants.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98039
EUVD
EUVD-2026-86692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of percpu kptr stores in BPF (Berkeley Packet Filter). The issue allows a plain allocation or kernel pointer to be stored in a __percpu_kptr map field without the required MEM_PERCPU permission flag. This can lead to arbitrary kernel read/write access or invalid memory access during map teardown.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking kernel version and BPF-related configurations. Use commands like 'uname -a' to check kernel version and 'lsmod | grep bpf' to verify BPF module status. Inspect BPF maps and programs with 'bpftool map list' and 'bpftool prog list'.

Impact Analysis

An attacker with BPF capabilities could exploit this to gain arbitrary kernel read/write access, potentially leading to privilege escalation, data theft, or system compromise. It may also cause kernel crashes or instability due to invalid memory access.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98039. Disable BPF if not required by unloading modules with 'rmmod bpfilter' or 'rmmod bpf'. Restrict BPF usage via kernel command line parameter 'bpf_restrict=1' or SELinux/AppArmor policies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98039. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart