CVE-2026-98149

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix percpu map update indexing with sparse CPU IDs

Per-CPU array, hash, and cgroup storage map updates without BPF_F_CPU

or BPF_F_ALL_CPUS use a value buffer whose per-CPU slots are packed in

possible-CPU order. The buffer is sized as:

round_up(value_size, 8) * num_possible_cpus()

The update paths iterate over possible CPUs, but use the logical CPU ID

to calculate the source offset:

value + size * cpu

This only works when possible CPU IDs are contiguous starting at zero.

For example, with a possible CPU mask of 0,2-3, the buffer contains

three slots corresponding to CPUs 0, 2, and 3. CPU2 is therefore

expected to use slot 1 and CPU3 slot 2. Instead, the current code uses

slots 2 and 3 respectively, causing incorrect per-CPU values and an

out-of-bounds read from the update buffer for CPU3.

The corresponding lookup paths already use a dense offset while

iterating over possible CPUs. Do the same for the a

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References