VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-98039: Linux kernel · bpf: Require MEM_PERCPU for percpu kptr stores

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in ad4ebae5dbc2d47b544aa54f03c12490065be08a : update Linux kernel when convenient.

Data as of 26 Oct 2026, 12:30 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in ad4ebae5dbc2d47b544aa54f03c12490065be08a, aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f, 048029ba1c793f8cabc4ad5eea765da01903f8f1 +1

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to ad4ebae5dbc2d47b544aa54f03c12490065be08a, aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f, 048029ba1c793f8cabc4ad5eea765da01903f8f1 or 0bdd6121c8dd5f1764efe701ce26bb8e15acb172.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 36d8bdf75a93190e5669b9d1d95994e13e15ba1d, < ad4ebae5dbc2d47b544aa54f03c12490065be08a	Fixed in ad4ebae5dbc2d47b544aa54f03c12490065be08a
LinuxLinux	Affected ≥ 36d8bdf75a93190e5669b9d1d95994e13e15ba1d, < aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f	Fixed in aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f
LinuxLinux	Affected ≥ 36d8bdf75a93190e5669b9d1d95994e13e15ba1d, < 048029ba1c793f8cabc4ad5eea765da01903f8f1	Fixed in 048029ba1c793f8cabc4ad5eea765da01903f8f1
LinuxLinux	Affected ≥ 36d8bdf75a93190e5669b9d1d95994e13e15ba1d, < 0bdd6121c8dd5f1764efe701ce26bb8e15acb172	Fixed in 0bdd6121c8dd5f1764efe701ce26bb8e15acb172
LinuxLinux	Affected =6.7	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEM_PERCPU for percpu kptr stores map_kptr_match_type() treats perm_flags as the set of register type flags that a kptr field permits. Adding MEM_PERCPU to that set for BPF_KPTR_PERCPU does not require the source register to carry it, however. The subset test consequently accepts both a plain bpf_obj_new() allocation and a referenced kernel pointer into a __percpu_kptr map field. Loads from the field are always marked MEM_PERCPU. Consumers then treat the stored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer helpers relocate it, and map teardown selects the per-CPU free path. A plain allocation can therefore provide an arbitrary kernel read/write, while a kernel pointer can be relocated into an invalid address or sent through a missing destructor. Require the source MEM_PERCPU flag to match the destination field kind. This preserves valid bpf_percpu_obj_new() stores and rejects both the program-BTF and kernel-BTF variants.

References

Community reviews

Loading reviews…