CVE-2026-98150
Received Received - Intake

BPF CPU Validation Fix in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpf_map_check_op_flags() currently compares that ID with num_possible_cpus(), which is the number of possible CPUs rather than a bound on CPU IDs. On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU mask was 0,2-3. A userspace program using raw bpf() syscalls creates a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations for each CPU by setting BPF_F_CPU and the CPU ID in the flags. With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map access path and triggers: Unable to handle kernel paging request at virtual address ... pc : __pi_memcpy_generic+0x5c/0x22c lr : bpf_percpu_array_update+0x2dc/0x2e8 Call trace: __pi_memcpy_generic bpf_map_update_value map_update_elem __sys_bpf Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This rejects CPU IDs outside the valid range and CPUs absent from the possible mask, while allowing valid sparse CPU IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98150
EUVD
EUVD-2026-86981

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect validation of CPU IDs in BPF (Berkeley Packet Filter) operations. The issue occurs when BPF_F_CPU is used to store a target CPU ID in the upper 32 bits of map operation flags. The current check compares this ID with num_possible_cpus(), which is the number of possible CPUs rather than a valid CPU ID bound. This leads to incorrect acceptance or rejection of CPU IDs, potentially causing kernel crashes when accessing per-CPU maps.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF implementation and may not have direct network detection methods. Check kernel logs for errors related to BPF operations or CPU handling. Use commands like 'dmesg | grep -i bpf' or 'journalctl -k | grep -i bpf' to inspect kernel logs for BPF-related errors.

Impact Analysis

This vulnerability can cause a kernel crash (paging fault) when a userspace program uses raw BPF syscalls to interact with BPF_MAP_TYPE_PERCPU_ARRAY. The crash occurs due to incorrect CPU ID validation, leading to invalid memory access. This may result in system instability or denial of service for systems running affected Linux kernel versions.

Mitigation Strategies

Update the Linux kernel to the latest patched version that includes the fix for this BPF vulnerability. Monitor kernel updates from your distribution vendor and apply them promptly. Avoid using raw BPF syscalls with BPF_F_CPU flags until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart