All vulnerabilities
CVE-2026-98033

Linux: bpf: Preserve inner map identity in callback frames

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in166221c52d3ca332f8699a854efca8e2704bb137Also 08b534bafdd9de65b6374474a8fe719c90eb3b01, 66ff2eff093d2a0838f39c713eeb590bc0946c2aCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 166221c52d3ca332f8699a854efca8e2704bb137LinuxCVE List
  • 08b534bafdd9de65b6374474a8fe719c90eb3b01LinuxCVE List
  • 66ff2eff093d2a0838f39c713eeb590bc0946c2aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Preserve inner map identity in callback frames

Callback frame constructors initialize map-typed argument registers with __mark_reg_known_zero() and then restore map_ptr. This clears map_uid, which is the only field distinguishing inner maps that share an inner_map_meta template.

When a timer callback invokes bpf_for_each_map_elem() on a second inner map, both the saved first map and the second map value can reach the nested callback as the same template with map_uid zero. bpf_timer_init() then accepts pairing the timer from the second map with the first map.

The runtime records the first map in the timer without taking a reference. Freeing that map does not find the timer stored in the second map, so a later timer callback dereferences the freed map.

Copy map_uid from the same caller register as map_ptr when constructing for-each, timer/workqueue, and task-work callback arguments. The existing identity check can then reject mismatched inner maps while allowing a callback value to be paired with its actual map.

Text from CVE List

Affected versions 12

  • Linuxaffected: 69c087ba6225b574afb6e505b72cb75242a3d844 before cf85e4f94d7feef8b3c4c90dbe2468595a48393bCVE List
  • Linuxaffected: 69c087ba6225b574afb6e505b72cb75242a3d844 before 166221c52d3ca332f8699a854efca8e2704bb137CVE List
  • Linuxaffected: 69c087ba6225b574afb6e505b72cb75242a3d844 before 08b534bafdd9de65b6374474a8fe719c90eb3b01CVE List
  • Linuxaffected: 69c087ba6225b574afb6e505b72cb75242a3d844 before 66ff2eff093d2a0838f39c713eeb590bc0946c2aCVE List
  • Linuxaffected: 69c087ba6225b574afb6e505b72cb75242a3d844 before b90c5d770dad910fb89e6c1b15052a8a1e8db752CVE List
  • Linuxaffected: 5.13CVE List
  • Linuxunaffected: all versions before 5.13CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5