BPF_F_CPU Vulnerability in Linux Kernel Affects CPU Operations

CVE-2026-98150

What is CVE-2026-98150?

A vulnerability in the Linux kernel involves an improper validation of CPU IDs within BPF_F_CPU operations. The BPF_F_CPU flag, which stores the target CPU ID in the upper 32 bits of the map operation flags, did not correctly validate the CPU ID against the number of available CPUs. This oversight allowed invalid IDs to be accepted, leading to potential memory access issues. Specifically, when a userspace program attempted to create and update elements in a BPF_MAP_TYPE_PERCPU_ARRAY with invalid CPU IDs, it led to kernel paging requests at unexpected memory addresses, causing system instability. The patch addresses these flaws by enforcing stricter checks against valid CPU ranges and ensuring that only appropriate CPU IDs are utilized in operations.

References