CVE-2026-98376
Description
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When replacing an inner per-CPU array map within a map-in-map structure, the kernel fails to verify that the replacement map matches the size of the original template map. A local attacker can exploit this flaw by substituting an inner map with one that has fewer entries, causing subsequent lookups to perform out-of-bounds memory access. This issue can lead to kernel memory corruption, resulting in a system crash (Denial of Service) or potential privilege escalation.
Statement
A BPF map compatibility check can allow a PERCPU_ARRAY inner map to be replaced with a smaller map because max_entries is not compared. The JIT compiled lookup continues to use the index_mask from the original template and can therefore access the replacement map pptrs array out of bounds. The immediate primitive is an out of bounds pointer load. Subsequent BPF access through the resulting per CPU value pointer creates a plausible path to an invalid kernel memory read or write, a kernel crash, information exposure, or local privilege escalation. For the CVSS the PR:L in the paranoid score reflects systems where unprivileged BPF is enabled or limited BPF capabilities are delegated to a local user or service account. The typical hardened configuration requires stronger BPF capabilities and is represented by PR:H in the base score. The issue is not network reachable and requires local BPF operations. Impact may include confidentiality, integrity, and availability compromise and should be reviewed manually.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
