In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sock_map_alloc()… (CVE-2026-98588)

The Linux kernel's sock_map_alloc() function previously accepted any u32 value for max_entries except zero, allowing values greater than INT_MAX. During sock_map_free(), a signed int iterator was used to walk the sks[] array, causing integer overflow and sign extension when max_entries exceeded INT_MAX. This led to out-of-bounds writes and potential memory corruption or kernel oopses, especially on large-memory hosts. The vulnerability was discovered and reproduced with syzkaller on kernels including 6.6-based KASAN and upstream v7.3-rc2. The fix involves rejecting max_entries values greater than INT_MAX at creation time to prevent overflow in the free function.

Exploitation can cause out-of-bounds memory writes during sockmap destruction, potentially leading to kernel crashes (oops), memory corruption, or denial of service. The fault can manifest as a page fault or corruption of unrelated allocations. No known exploits in the wild have been reported.

A fix is available that rejects max_entries values greater than INT_MAX during sockmap creation, preventing the signed integer overflow in sock_map_free(). Users should update to a kernel version that includes this fix. No additional mitigation is required beyond applying the official fix.