{"id":"CVE-2026-98376","summary":"bpf: Use array_map_meta_equal for percpu array inner map replacement","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Use array_map_meta_equal for percpu array inner map replacement\n\npercpu_array_map_ops.map_meta_equal points to the generic\nbpf_map_meta_equal(), which does not compare max_entries.  When a\npercpu array serves as an inner map, replacing it with one that has\nfewer max_entries bypasses the check.  Since percpu_array_map_gen_lookup()\ninlines the original template's index_mask as a JIT immediate, a lookup\non the replacement map can access pptrs[] out of bounds.\n\nPoint percpu_array_map_ops.map_meta_equal to array_map_meta_equal(),\nwhich already enforces the max_entries equality check.\n\nAdd a selftest to verify that replacing a percpu array inner map with\na differently-sized one is rejected.","modified":"2026-10-11T02:47:08.367901091Z","published":"2026-10-09T07:34:17.043Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98376.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/593980175389a05793f6060aa20e626330960395"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98376.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98376"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"db69718b8efac802c7cc20d5a6c7dfc913f99c43"},{"fixed":"593980175389a05793f6060aa20e626330960395"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98376.json"}}],"schema_version":"1.9.0"}