Linux Kernel BPF percpu_array_map_gen_lookup pptrs out-of-bounds

Summaryinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel. Affected by this issue is the function percpu_array_map_gen_lookup of the component BPF. The manipulation of the argument pptrs results in out-of-bounds. This vulnerability is identified as CVE-2026-98376. The attack can be executed remotely. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability classified as very critical has been found in Linux Kernel (affected version not known). Affected is the function percpu_array_map_gen_lookup of the component BPF. The manipulation of the argument pptrs with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds. Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which already enforces the max_entries equality check. Add a selftest to verify that replacing a percpu array inner map with a differently-sized one is rejected.

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-98376 since 09/25/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/10/2026).

The vulnerability scanner Nessus provides a plugin with the ID 364540 (Linux Distros Unpatched Vulnerability : CVE-2026-98376), which helps to determine the existence of the flaw in a target environment.

Applying the patch 593980175389a05793f6060aa20e626330960395 is able to eliminate this problem.

The vulnerability is also documented in the databases at Tenable (364540), EUVD (EUVD-2026-95531) and CERT Bund (WID-SEC-2026-3822). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion