Linux kernel BPF verifier: map-in-map lookup nullness elided using the wrong max_entries

Impact

An ARRAY_OF_MAPS built on a BPF_F_INNER_MAP template can have the template replaced at runtime by a concrete inner array with a different max_entries. The verifier still reasoned about the inner map using the template, so its const-key nullness elision concluded a lookup could not return NULL, while the runtime helper bounds-checks against the smaller concrete map and returns NULL. The program then dereferences a pointer the verifier promised was non-NULL - a kernel oops, scored AV:L/PR:L with availability impact only. On a GPU node this is a node-availability bug rather than a tenancy bug: BPF map-in-map is loaded by the CNI dataplane and observability agents that sit on every node, so a crash takes down the host and every GPU pod on it. The fix stops eliding nullness for maps flagged BPF_F_INNER_MAP.

Who can reach it

Local: a user or workload able to load BPF programs and create map-in-map objects - CAP_BPF/CAP_SYS_ADMIN, or any context where unprivileged BPF is enabled. An ordinary unprivileged GPU pod cannot reach this unless it has been granted BPF capabilities.

What to do

Take the stable kernel update with the verifier fix (d57db0d97505 and backports), then drain and reboot each node. As an interim control, confirm kernel.unprivileged_bpf_disabled is set and that no tenant workload holds CAP_BPF or CAP_SYS_ADMIN.

References

Related entries

• Linux mm/swap: full-cluster reclaim runs without rescheduling and softlocks large-core-count hostsCVE-2026-64415 · Linux kernel mm/swap (swap_reclaim_full_clusters, missing cond_resched)Medium
• Linux mm: NULL dereference in lookup_swap_cgroup_id panics swapless hosts at process exitCVE-2026-64416 · Linux kernel mm swap_cgroup (lookup_swap_cgroup_id on hosts with no swap)Medium
• Linux kernel io_uring: linked work items keep running after ring exit starts, stalling teardownCVE-2026-64425 · Linux kernel io_uring (io-wq worker exit handling)Medium
• Linux io_uring: NOP with IOSQE_FIXED_FILE leaks a struct file reference on every submissionCVE-2026-64426 · Linux kernel io_uring NOP opcode (IOSQE_FIXED_FILE handling)Medium
• Linux kernel (drivers/vfio/pci): The disable_idle_d3 power-management flag was a module-wide global that could changeCVE-2026-64476 · Linux kernel (drivers/vfio/pci)Medium
• Linux kernel (drivers/iommu/intel): SVA bind and unbind are asymmetric on VT-d hardware without PCI/PRI - bind skipsCVE-2026-64591 · Linux kernel (drivers/iommu/intel)Medium