BPF Update Vulnerability in Linux Kernel Affecting Performance Monitoring Features

CVE-2026-98149

What is CVE-2026-98149?

In the Linux kernel, a flaw exists that affects per-CPU array, hash, and cgroup storage map updates with BPF_F_CPU or BPF_F_ALL_CPUS not being utilized correctly. The issue arises from the incorrect handling of CPU IDs when updating values, leading to potential out-of-bounds reads and incorrect data assignments. The vulnerability specifically manifests in scenarios where the possible CPU IDs are non-contiguous. This flaw affects performance monitoring capabilities and requires careful attention from users to ensure secure and accurate operations.

References