Linux kernel bpf: percpu array inner map can be swapped for a smaller one, giving out-of-bounds access

Impact

percpu_array_map_ops used the generic map_meta_equal check, which does not compare max_entries, so an inner percpu array in a map-of-maps could be replaced by a smaller one. The JIT inlines the original template map's index_mask as an immediate, so a lookup against the replacement map indexes pptrs[] past its end - an out-of-bounds kernel access that can be turned into memory corruption and privilege escalation. Reaching it requires the ability to load BPF programs and update a map-in-map, which on a GPU node means a privileged agent or a container granted CAP_BPF: CNI dataplanes (Cilium), eBPF observability and profiling agents, and anything doing per-CPU counters. Remediation is a kernel update, which on a GPU node means draining long-running training or inference jobs.

Who can reach it

Local, and privileged: a process able to create BPF maps and perform inner-map replacement, i.e. CAP_BPF/CAP_SYS_ADMIN. Not reachable from an unprivileged tenant pod without those capabilities, and not remote.

What to do

Pick up the fix (commit 593980175389, which points percpu_array_map_ops.map_meta_equal at array_map_meta_equal) via a patched stable kernel from your distribution, then reboot each node - there is no runtime mitigation for the inlined index_mask. As an interim control, do not grant CAP_BPF or CAP_SYS_ADMIN to tenant workloads and keep BPF map-in-map use confined to trusted system agents. No fixed distribution version is stated in the record.

References

Related entries

• Linux BPF: link iterator takes a reference to an unsettled link, leading to use-after-freeCVE-2026-98378 · Linux kernel BPF link iterator (bpf_link_get_curr_or_next, unsettled links)Unscored
• Linux BPF: dev-bound-only program can attach to a sibling netdev and run driver-specific kfuncsCVE-2026-98382 · Linux kernel BPF offload matching (__bpf_offload_dev_match, dev-bound programs)Unscored
• Linux BPF: LWT_SEG6LOCAL program can leave a dangling SRH pointer via bpf_skb_pull_data()CVE-2026-98383 · Linux kernel BPF LWT_SEG6LOCAL (bpf_skb_pull_data with cached SRH)Unscored
• Linux BPF: bpf_sock_destroy() reads sk_protocol out of bounds on timewait and request socketsCVE-2026-98384 · Linux kernel bpf_sock_destroy() (sk_protocol read on timewait/request socks)Unscored
• Linux kernel sched/cache: use-after-free on mm_struct when a task switches address space during account_mm_sched()CVE-2026-98385 · Linux kernel scheduler (sched/cache, sched_cache_stat in mm_struct)Unscored
• ProFTPD mod_copy: unauthenticated SITE CPFR/CPTO gives arbitrary file read and writeCVE-2015-3306 · ProFTPD mod_copy (SITE CPFR / SITE CPTO)Critical