In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()… (CVE-2026-98644)

The Linux kernel's __htab_map_lookup_and_delete_batch() function in the BPF subsystem lacked rescheduling points during batch operations. The batch count limits how many entries are copied out but not how many buckets are visited, allowing a single BPF_MAP_LOOKUP_BATCH call to traverse the entire map. On large maps and multi-CPU systems, this caused CPUs to be held for extended periods (e.g., 77+ seconds on a 144-CPU arm64 host), triggering soft lockup watchdogs. The fix completes a prior patch by adding rescheduling points after processing 64 consecutive empty buckets and after copying data to user space, using cond_resched_tasks_rcu_qs() to yield and report quiescent states properly. This prevents CPUs from being held too long and avoids stalling RCU synchronization and tracing programs.

Systems running affected Linux kernel versions with large BPF hash maps and many CPUs may experience soft lockups, where CPUs are held for excessive time during batch map operations. This can degrade system responsiveness and stall kernel tracing and BPF program teardown. The issue primarily affects kernels configured without preemption (CONFIG_PREEMPT_NONE) on architectures like arm64. There is no indication of code execution or privilege escalation impact.

A fix has been implemented in the Linux kernel to add rescheduling points in the __htab_map_lookup_and_delete_batch() function, preventing soft lockups during batch operations. Users should update to a kernel version that includes commit 75134f16e7dd and the subsequent fix completing it for the htab-native path. Patch status is confirmed by the vendor's commit history. No additional mitigations are required once the fix is applied.