CVE-2026-98588

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

sock_map_alloc() only rejects max_entries == 0 and otherwise allows any

u32 value. sock_map_free() then walks the sks[] array with a signed int

iterator:

int i;

for (i = 0; i < stab->map.max_entries; i++)

struct sock **psk = &stab->sks[i];

When a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the

allocation of 32 GiB can succeed on large-memory hosts. During free the

counter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq

and turned into a ~16 GiB negative offset from stab->sks, pointing far

below the allocation.

The faulting access is an xchg() write in sock_map_free(). Without

KASAN, the same out-of-bounds write can fault on an unmapped vmalloc page

or corrupt an unrelated allocation if that vmalloc address is populated.

On a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that

address hits an unmapp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References