CVE-2026-98039

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Require MEM_PERCPU for percpu kptr stores

map_kptr_match_type() treats perm_flags as the set of register type flags

that a kptr field permits. Adding MEM_PERCPU to that set for

BPF_KPTR_PERCPU does not require the source register to carry it, however.

The subset test consequently accepts both a plain bpf_obj_new() allocation

and a referenced kernel pointer into a __percpu_kptr map field.

Loads from the field are always marked MEM_PERCPU. Consumers then treat the

stored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer

helpers relocate it, and map teardown selects the per-CPU free path. A plain

allocation can therefore provide an arbitrary kernel read/write, while a

kernel pointer can be relocated into an invalid address or sent through a

missing destructor.

Require the source MEM_PERCPU flag to match the destination field kind.

This preserves valid bpf_percpu_obj_new() stores and rejects bo

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References