CVE-2026-98787
Received Received - Intake

BPF Race Condition in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch() bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration to be disabled. All callers of rhtab_delete_elem() disable migration except __rhtab_map_lookup_and_delete_batch(), which calls it under rcu_read_lock() only. On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or migration, so the task can migrate between CPUs during the delete loop, causing this_cpu_ptr() to trigger: BUG: using smp_processor_id() in preemptible [00000000] code Fix by wrapping the delete loop in migrate_disable()/migrate_enable() in __rhtab_map_lookup_and_delete_batch(), matching the migration protection that the other callers already provide.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98787
EUVD
EUVD-2026-103872

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux 818e0084822742fc00eacbf5df3476a5e72c7d0e
Linux Linux 818e0084822742fc00eacbf5df3476a5e72c7d0e
Linux Linux 7.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) subsystem. The issue occurs in the function __rhtab_map_lookup_and_delete_batch() which fails to disable CPU migration before calling bpf_mem_cache_free_rcu(). This function uses this_cpu_ptr() which requires migration to be disabled. Without proper protection, the task can migrate between CPUs during execution, causing a bug where smp_processor_id() is used in preemptible code.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires kernel-level detection. Check if your kernel version includes the vulnerable code path by examining the BPF subsystem. Look for kernel logs containing 'BUG: using smp_processor_id() in preemptible code' or crashes in BPF-related operations.

Impact Analysis

This vulnerability could cause system instability or crashes on Linux systems using BPF with CONFIG_PREEMPT_RCU enabled. It may lead to kernel bugs or unexpected behavior during BPF operations, potentially affecting performance or causing system hangs.

Mitigation Strategies

Apply the latest kernel patch that fixes this issue. If a patch is unavailable, avoid using BPF features that trigger the vulnerable code path (__rhtab_map_lookup_and_delete_batch). Monitor kernel logs for related errors and consider disabling BPF if not critical.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98787. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart