CVE-2026-98376

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When replacing an inner per-CPU array map within a map-in-map structure, the kernel fails to verify that the replacement map matches the size of the original template map. A local attacker can exploit this flaw by substituting an inner map with one that has fewer entries, causing subsequent lookups to perform out-of-bounds memory access. This issue can lead to kernel memory corruption, resulting in a system crash (Denial of Service) or potential privilege escalation.

A BPF map compatibility check can allow a PERCPU_ARRAY inner map to be replaced with a smaller map because max_entries is not compared. The JIT compiled lookup continues to use the index_mask from the original template and can therefore access the replacement map pptrs array out of bounds. The immediate primitive is an out of bounds pointer load. Subsequent BPF access through the resulting per CPU value pointer creates a plausible path to an invalid kernel memory read or write, a kernel crash, information exposure, or local privilege escalation. For the CVSS the PR:L in the paranoid score reflects systems where unprivileged BPF is enabled or limited BPF capabilities are delegated to a local user or service account. The typical hardened configuration requires stronger BPF capabilities and is represented by PR:H in the base score. The issue is not network reachable and requires local BPF operations. Impact may include confidentiality, integrity, and availability compromise and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.