All vulnerabilities
CVE-2026-98376

Linux: bpf: Use array_map_meta_equal for percpu array inner map replacement

Linux LinuxOperating systems
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 3% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in593980175389a05793f6060aa20e626330960395Fixed versionCVE List
Published9 Oct 2026Updated 9 Oct 2026CVE List

What fixes it

  • 593980175389a05793f6060aa20e626330960395LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use array_map_meta_equal for percpu array inner map replacement

percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds.

Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which already enforces the max_entries equality check.

Add a selftest to verify that replacing a percpu array inner map with a differently-sized one is rejected.

Text from CVE List

Affected versions 4

  • Linuxaffected: db69718b8efac802c7cc20d5a6c7dfc913f99c43 before 593980175389a05793f6060aa20e626330960395CVE List
  • Linuxaffected: 6.10CVE List
  • Linuxunaffected: all versions before 6.10CVE List
  • Linuxunaffected: 7.1CVE List

References 1