CVE-2026-98376: Linux Kernel BPF Privilege Escalation Flaw

CVE-2026-98376 Overview

CVE-2026-98376 is a Linux kernel vulnerability in the Berkeley Packet Filter (BPF) subsystem. The flaw affects percpu_array_map_ops, which incorrectly used the generic bpf_map_meta_equal() function for inner map replacement validation. The generic check does not compare max_entries between the original and replacement maps. An attacker able to load BPF programs can replace a percpu array inner map with a smaller one, causing out-of-bounds access to the pptrs[] array during lookup operations. The kernel upstream fix repoints percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which enforces the required equality check.

Critical Impact
Local users with BPF privileges can trigger out-of-bounds memory access in the kernel, potentially leading to information disclosure, denial of service, or privilege escalation.

Affected Products

Linux kernel BPF subsystem
Builds using percpu_array_map_ops with inner map replacement
Specific affected version ranges are not enumerated in the available NVD data

Discovery Timeline

2026-10-09 - CVE-2026-98376 published to the National Vulnerability Database
2026-10-09 - Last updated in NVD database

Technical Details for CVE-2026-98376

Vulnerability Analysis

The vulnerability resides in the BPF map-in-map feature, which allows one BPF map to contain references to other BPF maps as inner elements. When an inner map is replaced at runtime, the kernel validates that the new map is compatible with the original template by calling the map_meta_equal function pointer registered for that map type.

For percpu arrays, percpu_array_map_ops.map_meta_equal pointed to the generic bpf_map_meta_equal() helper. That helper compares the map's key size, value size, map flags, and other generic attributes, but it does not compare max_entries. As a result, the kernel accepted a replacement percpu array with fewer entries than the original template.

The JIT-compiled lookup code generated by percpu_array_map_gen_lookup() inlines the original template's index_mask as an immediate operand. When a lookup runs against the smaller replacement map, the inlined mask still references the larger index range, so the generated code can index pptrs[] past the replacement map's actual allocation.

Root Cause

The root cause is an incorrect function pointer assignment that selected a weaker validator [CWE-125 Out-of-bounds Read, CWE-787 Out-of-bounds Write]. Because percpu_array_map_gen_lookup() bakes the index mask into JIT code at the time the outer map is created, any later replacement must preserve max_entries. The generic bpf_map_meta_equal() did not enforce that invariant.

Attack Vector

Exploitation requires local access and the ability to load BPF programs, typically CAP_BPF or CAP_SYS_ADMIN. An attacker creates an outer map-of-maps whose template is a percpu array with a given max_entries. The attacker then substitutes a percpu array inner map with fewer max_entries. Lookups performed through the outer map use the JIT-inlined mask from the original template, dereferencing pptrs[] beyond the replacement map's bounds.

The vulnerability is described in prose only; refer to the upstream commit for the exact code change. See the Linux kernel commit 593980175389 for implementation details.

Detection Methods for CVE-2026-98376

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN reports referencing percpu_array_map_gen_lookup or array_map_lookup_elem
Processes with CAP_BPF or CAP_SYS_ADMIN loading unexpected BPF map-in-map structures
bpf() syscall activity that creates percpu array inner maps and subsequently replaces them with smaller variants

Detection Strategies

Audit bpf() syscall telemetry for BPF_MAP_CREATE operations followed by BPF_MAP_UPDATE_ELEM calls that swap inner maps
Enable KASAN on test and canary systems to surface out-of-bounds access in BPF code paths
Monitor kernel log output for warnings generated by BPF verifier changes introduced by the upstream patch

Monitoring Recommendations

Collect kernel audit logs for processes invoking the bpf() syscall and alert on unexpected privileged callers
Track installed kernel versions across the fleet and compare against vendor advisories as they are published
Review eBPF program load events in container and Kubernetes environments where workloads may hold CAP_BPF

How to Mitigate CVE-2026-98376

Immediate Actions Required

Apply the upstream Linux kernel patch referenced in commit 593980175389 once your distribution ships it
Inventory systems that permit unprivileged or containerized workloads to load BPF programs
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted workloads until the patch is deployed

Patch Information

The fix changes percpu_array_map_ops.map_meta_equal to point at array_map_meta_equal(), which already enforces the max_entries equality check during inner map replacement. The upstream commit also adds a selftest that verifies replacement of a percpu array inner map with a differently-sized map is rejected. Track your distribution's stable kernel updates for inclusion of the fix. Reference: Linux kernel commit 593980175389.

Workarounds

Set kernel.unprivileged_bpf_disabled=1 via sysctl to prevent unprivileged users from loading BPF programs
Remove CAP_BPF from container runtime defaults where eBPF functionality is not required
Use Linux Security Modules such as SELinux or AppArmor to constrain which processes may issue the bpf() syscall

bash

# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf

# Verify the setting is active
sysctl kernel.unprivileged_bpf_disabled