CVE-2026-98149

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Linux Kernel BPF

Publication date: 2026-09-25

Last updated on: 2026-09-30

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU or BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is sized as: round_up(value_size, 8) * num_possible_cpus() The update paths iterate over possible CPUs, but use the logical CPU ID to calculate the source offset: value + size * cpu This only works when possible CPU IDs are contiguous starting at zero. For example, with a possible CPU mask of 0,2-3, the buffer contains three slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore expected to use slot 1 and CPU3 slot 2. Instead, the current code uses slots 2 and 3 respectively, causing incorrect per-CPU values and an out-of-bounds read from the update buffer for CPU3. The corresponding lookup paths already use a dense offset while iterating over possible CPUs. Do the same for the array, hash, and cgroup storage update paths, advancing the source offset once for each possible CPU. BPF_F_ALL_CPUS continues to use the same value for every CPU.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98149

EUVD

EUVD-2026-86980

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects BPF (Berkeley Packet Filter) per-CPU map updates. When CPU IDs are not contiguous, the update paths incorrectly calculate offsets using logical CPU IDs instead of dense possible-CPU order. This causes wrong per-CPU values and an out-of-bounds read for certain CPUs.

Detection Guidance

This vulnerability affects the Linux kernel's BPF (Berkeley Packet Filter) implementation, specifically in percpu map updates with sparse CPU IDs. Detection requires checking kernel version and BPF-related configurations. Use 'uname -r' to check kernel version and 'cat /proc/cpuinfo' to inspect CPU topology. Look for sparse CPU IDs (non-contiguous) in the output.

Impact Analysis

This flaw could lead to incorrect data processing in BPF programs using per-CPU maps, potentially causing crashes, data corruption, or security issues. Systems with sparse or non-contiguous CPU configurations are most affected.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel issue related to incorrect per-CPU value handling in BPF maps. Compliance impact would depend on system-specific usage of affected BPF features.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve the BPF percpu map update indexing issue with sparse CPU IDs.

Hi! I’m here to help you understand CVE-2026-98149. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70