CVE-2026-98376 in Linux
Summary
by MITRE • 10/09/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use array_map_meta_equal for percpu array inner map replacement
percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds.
Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which already enforces the max_entries equality check.
Add a selftest to verify that replacing a percpu array inner map with a differently-sized one is rejected.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/09/2026
The Linux kernel's Berkeley Packet Filter (BPF) subsystem provides a powerful framework for running sandboxed programs in the kernel, enabling high-performance packet filtering and observability tools. A critical security flaw was identified within the handling of per-CPU array maps when they are used as inner maps within BPF map structures. The vulnerability stems from an inconsistency in how metadata equality is validated during map replacement operations. Specifically, the function pointer for map_meta_equal in the percpu_array_map_ops structure incorrectly pointed to the generic bpf_map_meta_equal implementation rather than a specialized comparator suitable for array-based maps. This oversight created a logic error that allowed attackers to bypass essential validation checks when attempting to replace an existing inner map with a new one of different dimensions.
The core technical flaw lies in the failure to compare the max_entries field during the metadata equality check performed by bpf_map_meta_equal. When a per-CPU array serves as an inner map, the kernel must ensure that any replacement map maintains structural compatibility to prevent memory corruption or out-of-bounds access. The generic comparator did not enforce strict equality on the maximum number of entries allowed in the map structure. Consequently, if a user-space application attempted to replace a percpu array inner map with another array map having fewer max_entries values, this operation would be erroneously permitted by the kernel's validation logic. This bypass effectively disables a crucial safety mechanism designed to maintain memory integrity within the BPF subsystem.
The operational impact of this vulnerability is severe due to how the BPF Just-In-Time (JIT) compiler optimizes lookups for per-CPU arrays. The function percpu_array_map_gen_lookup inlines the original template's index_mask as a JIT immediate value during program compilation. This optimization assumes that the underlying map structure remains static and compatible with the pre-calculated bounds used by the generated machine code. When an attacker successfully replaces the inner map with one having fewer entries, the lookup operation continues to use the outdated index mask derived from the original larger map. As a result, subsequent lookups can access pointers within the pptrs array out of its valid boundaries. This leads to arbitrary memory read or write capabilities depending on the specific context and data accessed, potentially allowing privilege escalation or kernel panic through buffer overflow conditions in kernel space.
This vulnerability aligns with CWE-20 Improper Input Validation, as the system failed to adequately validate input parameters during a critical state transition involving map replacement. Furthermore, it relates to CWE-787 Out-of-bounds Write and CWE-125 Out-of-bounds Read, given that the JIT-generated code accesses memory locations beyond the allocated array limits. From an ATT&CK perspective, this flaw facilitates lateral movement and privilege escalation within compromised systems by allowing attackers to exploit kernel-level memory corruption for arbitrary code execution or information disclosure. The exploitation vector typically involves local users with BPF permissions attempting to manipulate map structures via system calls such as bpf_map_update_elem or related replacement operations.
To mitigate this risk, the Linux kernel maintainers have updated the percpu_array_map_ops structure to point its map_meta_equal function pointer to array_map_meta_equal instead of the generic comparator. This specialized function correctly enforces strict equality checks on max_entries and other critical structural parameters before allowing a map replacement operation. By ensuring that inner maps cannot be swapped with incompatible sizes, the kernel prevents the JIT compiler from generating code that relies on stale bounds information. Additionally, self-tests have been added to verify that replacing a percpu array inner map with one of a different size is properly rejected by the validation logic. System administrators should ensure their kernels are updated to include this patch and restrict BPF program loading privileges to trusted users only to minimize the attack surface for potential exploitation attempts involving kernel memory manipulation.