CVE-2026-98150

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix BPF_F_CPU validation for sparse CPU IDs

BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map

operation flags. bpf_map_check_op_flags() currently compares that ID

with num_possible_cpus(), which is the number of possible CPUs rather

than a bound on CPU IDs.

On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU

mask was 0,2-3. A userspace program using raw bpf() syscalls creates

a BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations

for each CPU by setting BPF_F_CPU and the CPU ID in the flags.

With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is

rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map

access path and triggers:

Unable to handle kernel paging request at virtual address ...

pc : __pi_memcpy_generic+0x5c/0x22c

lr : bpf_percpu_array_update+0x2dc/0x2e8

Call trace:

__pi_memcpy_generic

bpf_map_update_value

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References