{"id":41060,"date":"2026-10-19T00:31:59","date_gmt":"2026-10-18T16:31:59","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98588"},"modified":"2026-10-19T00:31:59","modified_gmt":"2026-10-18T16:31:59","slug":"cve-2026-98588","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98588","title":{"rendered":"CVE-2026-98588 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf, sockmap: Reject max_entries &gt; INT_MAX in sock_map_alloc<\/p>\n<p>sock_map_alloc() only rejects max_entries == 0 and otherwise allows any<br \/>\nu32 value.  sock_map_free() then walks the sks[] array with a signed int<br \/>\niterator:<\/p>\n<p>\tint i;<br \/>\n\tfor (i = 0; i map.max_entries; i++)<br \/>\n\t\tstruct sock **psk = &amp;stab-&gt;sks[i];<\/p>\n<p>When a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the<br \/>\nallocation of 32 GiB can succeed on large-memory hosts.  During free the<br \/>\ncounter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq<br \/>\nand turned into a ~16 GiB negative offset from stab-&gt;sks, pointing far<br \/>\nbelow the allocation.<\/p>\n<p>The faulting access is an xchg() write in sock_map_free().  Without<br \/>\nKASAN, the same out-of-bounds write can fault on an unmapped vmalloc page<br \/>\nor corrupt an unrelated allocation if that vmalloc address is populated.<br \/>\nOn a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that<br \/>\naddress hits an unmapped shadow page and oopses first:<\/p>\n<p>  BUG: unable to handle page fault for address: fffff521b59c5a00<br \/>\n  RIP: 0010:kasan_check_range+0x107\/0x190<br \/>\n  Call Trace:<br \/>\n   sock_map_free+0x93\/0x190<br \/>\n   map_create+0x68d\/0xb30<br \/>\n   __sys_bpf+0x21e\/0x2e70<\/p>\n<p>Vmcore confirmed stab-&gt;map.max_entries == 0xffffffff, stab-&gt;sks ==<br \/>\n0xffffc911ace2d000, and the faulting address sks + (s64)INT_MIN * 8<br \/>\nexactly at 0xffffc90dace2d000.  The same buggy path is reached on the<br \/>\nnormal close()\/bpf_map_free_deferred() path whenever such a map is<br \/>\ndestroyed.<\/p>\n<p>sock_map_alloc() used to bound its allocation size through<br \/>\nbpf_map_charge_init(), but the bound was dropped when rlimit-based memory<br \/>\naccounting was removed.  Reject max_entries &gt; INT_MAX at creation time so<br \/>\nthe signed iterator in sock_map_free() never sees a value that would<br \/>\noverflow.<\/p>\n<p>Triggered by syzkaller and reproduced on both a 6.6-based KASAN kernel<br \/>\nand the upstream v7.3-rc2 kernel.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf, sockmap: Reject max_entries &gt; INT_MAX in sock_map_alloc<\/p>\n<p>sock_map_alloc() only rejects max_entries == 0 and otherwise allows a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41060","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41060","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41060"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41060"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41060"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}