CVE-2026-98150 (GCVE-0-2026-98150)

Vulnerability from cvelistv5 – Published: 2026-09-25 10:36 – Updated: 2026-09-25 14:42
VLAI
Title
bpf: Fix BPF_F_CPU validation for sparse CPU IDs
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPF_F_CPU validation for sparse CPU IDs BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpf_map_check_op_flags() currently compares that ID with num_possible_cpus(), which is the number of possible CPUs rather than a bound on CPU IDs. On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU mask was 0,2-3. A userspace program using raw bpf() syscalls creates a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations for each CPU by setting BPF_F_CPU and the CPU ID in the flags. With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map access path and triggers: Unable to handle kernel paging request at virtual address ... pc : __pi_memcpy_generic+0x5c/0x22c lr : bpf_percpu_array_update+0x2dc/0x2e8 Call trace: __pi_memcpy_generic bpf_map_update_value map_update_elem __sys_bpf Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This rejects CPU IDs outside the valid range and CPUs absent from the possible mask, while allowing valid sparse CPU IDs.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2b421662c7887a0649fe409155a1f101562d0fa9 , < bdc5941f6eeef90b76a07fd8ca38ac1933ba2195 (git)
Affected: 2b421662c7887a0649fe409155a1f101562d0fa9 , < ed54bf564ac52699cf4def3d0c2125d493e756f9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.0
Unaffected: 0 , < 7.0 (semver)
Unaffected: 7.2.7 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bdc5941f6eeef90b76a07fd8ca38ac1933ba2195",
              "status": "affected",
              "version": "2b421662c7887a0649fe409155a1f101562d0fa9",
              "versionType": "git"
            },
            {
              "lessThan": "ed54bf564ac52699cf4def3d0c2125d493e756f9",
              "status": "affected",
              "version": "2b421662c7887a0649fe409155a1f101562d0fa9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc2",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix BPF_F_CPU validation for sparse CPU IDs\n\nBPF_F_CPU stores the target CPU ID in the upper 32 bits of the map\noperation flags. bpf_map_check_op_flags() currently compares that ID\nwith num_possible_cpus(), which is the number of possible CPUs rather\nthan a bound on CPU IDs.\n\nOn an arm64 QEMU guest with a CPU device-tree hole, the possible CPU\nmask was 0,2-3. A userspace program using raw bpf() syscalls creates\na BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations\nfor each CPU by setting BPF_F_CPU and the CPU ID in the flags.\n\nWith the old check, CPU 1 is incorrectly accepted while valid CPU 3 is\nrejected with -ERANGE. The CPU 1 update then reaches the per-CPU map\naccess path and triggers:\n\n  Unable to handle kernel paging request at virtual address ...\n  pc : __pi_memcpy_generic+0x5c/0x22c\n  lr : bpf_percpu_array_update+0x2dc/0x2e8\n  Call trace:\n    __pi_memcpy_generic\n    bpf_map_update_value\n    map_update_elem\n    __sys_bpf\n\nCheck the CPU ID against nr_cpu_ids and cpu_possible() instead. This\nrejects CPU IDs outside the valid range and CPUs absent from the\npossible mask, while allowing valid sparse CPU IDs."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The out-of-range CPU ID arrives in attr-\u003eflags of the local bpf(2) BPF_MAP_UPDATE_ELEM/LOOKUP_ELEM syscall (map_update_elem/map_lookup_elem -\u003e bpf_map_check_op_flags); no network or adjacent protocol carries it.\nAC:H - The check only lets through a CPU ID in a hole of the possible-CPU mask (e.g. 0,2-3 on arm64 device-tree systems). That topology comes from firmware/hardware and the attacker can\u0027t create it. It also needs a permissive BPF setup, and where the stray per_cpu_ptr() lands (unmapped init memory vs mapped .data) depends on percpu allocator placement.\nPR:L - BPF_MAP_TYPE_PERCPU_ARRAY/PERCPU_HASH are in map_create()\u0027s unprivileged list when unprivileged_bpf_disabled=0 or with a delegated BPF token, and map_update_elem/map_lookup_elem check only FMODE_CAN_WRITE/READ on the map fd, not a capability.\nUI:N - The attacker creates or opens the per-CPU map and issues the update/lookup with BPF_F_CPU and a hole CPU ID entirely on their own; no other user acts.\nS:U - The bad access corrupts or reads kernel memory within the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - bpf_percpu_array_copy() copies value_size bytes from per_cpu_ptr(pptr, cpu) for a missing CPU whose __per_cpu_offset is 0, i.e. from a stray kernel address, back to userspace via BPF_MAP_LOOKUP_ELEM, and the attacker can repeat it.\nI:H - bpf_percpu_array_update() does copy_map_value() of attacker-supplied value bytes to per_cpu_ptr(pptr, cpu) for the missing CPU. That is an out-of-bounds write of controlled data to an address outside any valid per-CPU unit, which can land in kernel .data past __init_end.\nA:H - As the fix commit shows, the update faults in __pi_memcpy_generic from bpf_percpu_array_update on unmapped memory (the freed/vunmapped __init region on arm64), causing a kernel oops."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:42:12.855Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bdc5941f6eeef90b76a07fd8ca38ac1933ba2195"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed54bf564ac52699cf4def3d0c2125d493e756f9"
        }
      ],
      "title": "bpf: Fix BPF_F_CPU validation for sparse CPU IDs",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98150",
    "datePublished": "2026-09-25T10:36:22.774Z",
    "dateReserved": "2026-09-25T10:25:14.320Z",
    "dateUpdated": "2026-09-25T14:42:12.855Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/bpf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bdc5941f6eeef90b76a07fd8ca38ac1933ba2195",
                    "status": "affected",
                    "version": "2b421662c7887a0649fe409155a1f101562d0fa9",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ed54bf564ac52699cf4def3d0c2125d493e756f9",
                    "status": "affected",
                    "version": "2b421662c7887a0649fe409155a1f101562d0fa9",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/linux/bpf.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.0"
                  },
                  {
                    "lessThan": "7.0",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.7",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix BPF_F_CPU validation for sparse CPU IDs\n\nBPF_F_CPU stores the target CPU ID in the upper 32 bits of the map\noperation flags. bpf_map_check_op_flags() currently compares that ID\nwith num_possible_cpus(), which is the number of possible CPUs rather\nthan a bound on CPU IDs.\n\nOn an arm64 QEMU guest with a CPU device-tree hole, the possible CPU\nmask was 0,2-3. A userspace program using raw bpf() syscalls creates\na BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations\nfor each CPU by setting BPF_F_CPU and the CPU ID in the flags.\n\nWith the old check, CPU 1 is incorrectly accepted while valid CPU 3 is\nrejected with -ERANGE. The CPU 1 update then reaches the per-CPU map\naccess path and triggers:\n\n  Unable to handle kernel paging request at virtual address ...\n  pc : __pi_memcpy_generic+0x5c/0x22c\n  lr : bpf_percpu_array_update+0x2dc/0x2e8\n  Call trace:\n    __pi_memcpy_generic\n    bpf_map_update_value\n    map_update_elem\n    __sys_bpf\n\nCheck the CPU ID against nr_cpu_ids and cpu_possible() instead. This\nrejects CPU IDs outside the valid range and CPUs absent from the\npossible mask, while allowing valid sparse CPU IDs."
          }
        ],
        "id": "CVE-2026-98150",
        "lastModified": "2026-09-25T15:18:06.997",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-25T11:17:46.580",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bdc5941f6eeef90b76a07fd8ca38ac1933ba2195"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed54bf564ac52699cf4def3d0c2125d493e756f9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.