Linux kernel BPF: per-CPU map updates index by logical CPU id, reading past the update buffer

Impact

Per-CPU array, hash and cgroup-storage map updates without BPF_F_CPU or BPF_F_ALL_CPUS use a value buffer sized round_up(value_size, 8) * num_possible_cpus(), with slots packed in possible-CPU order. The update paths iterated possible CPUs but computed the source offset from the logical CPU id, which is only correct when possible CPU ids are contiguous from zero. With a sparse possible-CPU mask - 0,2-3 in the kernel's own example - the last CPU reads past the end of the update buffer and every offline-gap CPU gets the wrong value. Sparse CPU masks are not exotic on large NUMA GPU hosts and on nodes where CPUs are offlined for isolation, so this is both a kernel out-of-bounds read and a silent data-correctness bug in per-CPU maps that observability and networking agents rely on.

Who can reach it

Local caller of bpf() map update on a per-CPU map - any process or container with BPF map access - on a host whose possible-CPU ids are non-contiguous. No remote path.

What to do

Update to a stable kernel with the fix that advances the source offset once per possible CPU in the array, hash and cgroup-storage update paths, matching the lookup paths; both commits are in the record. Kernel package plus node reboot. As an interim check, confirm whether your hosts actually have a sparse possible-CPU mask - on nodes with contiguous ids the bug does not trigger.

References

Related entries

• Linux kernel RDMA/rxe: ODP write paths accept read-only pages, letting RDMA traffic overwrite the page cacheCVE-2026-98361 · Linux kernel RDMA/rxe (soft-RoCE on-demand paging write path)High
• Linux kernel RDMA/rxe: MR re-registration swaps the PD before validating access flags, freeing a live PDCVE-2026-98366 · Linux kernel RDMA/rxe rxe_rereg_user_mr() (access-flag validation ordering)High
• Linux kernel RDMA/siw: failed QP modify in siw_accept() races QP-to-ERROR transition into a use-after-freeCVE-2026-98367 · Linux kernel RDMA/siw siw_accept() (CEP association cleared outside state_lock)High
• Linux kernel mm/rmap: missing barrier lets a reused anon_vma hang tasks and use-after-free its rootCVE-2026-98507 · Linux kernel mm/rmap (anon_vma publish without memory barrier)High
• Linux kernel rds/ib: stale scatterlist after failed MR registration gives a use-after-free on teardownCVE-2026-98524 · Linux kernel RDS over InfiniBand (rds_ib_map_frmr scatterlist ownership)High
• Linux kernel BPF verifier: missed zero-extension marking lets a loaded program inject arbitrary register upper halvesCVE-2026-98869 · Linux kernel BPF verifier (32-bit subregister zero-extension / zext_dst inference)High