CVE-2026-93174
kernel: bpf: Copy per-CPU map value padding in copy_map_value_long()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 20, 2026
Description
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When handling per-CPU map elements, the copy_map_value_long() function incorrectly copies only the map->value_size instead of the full allocated size, which includes padding. This oversight can lead to user-space applications, through UAPI lookup operations or bpf_iter, receiving uninitialized or stale heap memory contents from the uncopied padding. This could result in information disclosure.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-201 · Insertion of Sensitive Information Into Sent Data