{"id":29304,"date":"2026-09-25T20:32:23","date_gmt":"2026-09-25T12:32:23","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98150"},"modified":"2026-09-25T20:32:23","modified_gmt":"2026-09-25T12:32:23","slug":"cve-2026-98150","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98150","title":{"rendered":"CVE-2026-98150 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix BPF_F_CPU va"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf: Fix BPF_F_CPU validation for sparse CPU IDs<\/p>\n<p>BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map<br \/>\noperation flags. bpf_map_check_op_flags() currently compares that ID<br \/>\nwith num_possible_cpus(), which is the number of possible CPUs rather<br \/>\nthan a bound on CPU IDs.<\/p>\n<p>On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU<br \/>\nmask was 0,2-3. A userspace program using raw bpf() syscalls creates<br \/>\na BPF_MAP_TYPE_PERCPU_ARRAY and performs update and lookup operations<br \/>\nfor each CPU by setting BPF_F_CPU and the CPU ID in the flags.<\/p>\n<p>With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is<br \/>\nrejected with -ERANGE. The CPU 1 update then reaches the per-CPU map<br \/>\naccess path and triggers:<\/p>\n<p>  Unable to handle kernel paging request at virtual address &#8230;<br \/>\n  pc : __pi_memcpy_generic+0x5c\/0x22c<br \/>\n  lr : bpf_percpu_array_update+0x2dc\/0x2e8<br \/>\n  Call trace:<br \/>\n    __pi_memcpy_generic<br \/>\n    bpf_map_update_value<br \/>\n    map_update_elem<br \/>\n    __sys_bpf<\/p>\n<p>Check the CPU ID against nr_cpu_ids and cpu_possible() instead. This<br \/>\nrejects CPU IDs outside the valid range and CPUs absent from the<br \/>\npossible mask, while allowing valid sparse CPU IDs.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf: Fix BPF_F_CPU validation for sparse CPU IDs<\/p>\n<p>BPF_F_CPU stores the target CPU ID in the upper 32 bits of the map<br \/>\noperation flag<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29304","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}