CVE-2026-98644

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()

__htab_map_lookup_and_delete_batch() has no rescheduling point. The

batch count bounds how many entries are copied out, not how many

buckets are visited, so one BPF_MAP_LOOKUP_BATCH call can walk the

map end to end. The empty-bucket fast path is worse: it stays inside

a single rcu_read_lock() / bpf_disable_instrumentation() section for

any run of consecutive empty buckets.

That holds up on small maps, but it falls apart at scale. On a

144-CPU arm64 host running a CONFIG_PREEMPT_NONE kernel, periodic

BPF_MAP_LOOKUP_BATCH calls against an LRU hash map with 16,777,216

buckets held a CPU inside the batch op for 77+ seconds and triggered

the soft lockup watchdog.

Commit 75134f16e7dd ("bpf: Add schedule points in batch ops") fixed this

same problem in the generic batch ops, but not in this htab-native path,

which every htab-based hash map variant uses for its

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References