CVE-2026-98376High· 7.0▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: bpf: Use array_map_meta_equal for percpu array inner map replacement percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not com…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
— → 7
none → high
0.1% → 0.2%
In the Linux kernel, the following vulnerability has been resolved:
bpf: Use array_map_meta_equal for percpu array inner map replacement
percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds.
Point percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which already enforces the max_entries equality check.
Add a selftest to verify that replacing a percpu array inner map with a differently-sized one is rejected.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72107Medium· 5.5kernel: dm era: fix out-of-bounds memory access for non-zero start sector (CVE-2026-72107)
CVE-2026-64551High· 7.0kernel: sctp: validate STALE_COOKIE cause length before reading staleness (CVE-2026-64551)
CVE-2026-64540Medium· 5.5kernel: usbnet: gl620a: fix out-of-bounds read in genelink_rx_fixup() (CVE-2026-64540)
CVE-2026-64524Medium· 5.5kernel: drm/hyperv: validate resolution_count and fix WIN8 fallback (CVE-2026-64524)
CVE-2023-54116High· 7.8In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-generic: prohibit potential out-of-bounds access The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-gene…
CVE-2026-80779Medium· 4.4kernel: net/ionic: avoid OOB TX partner lookup for hwstamp RXQ (CVE-2026-80779)