bpf: Require MEM_PERCPU for percpu kptr stores

Answer in brief

CVE-2026-98039 records a Unknown severity vulnerability in bpf: Require MEM_PERCPU for percpu kptr stores. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 25, 2026Updated Sep 25, 2026Source checked Sep 25, 2026First seen by HOL Sep 25, 2026Material review Sep 25, 2026

Upstream Advisory

Key facts

Risk: Unknown severitySource severity not reported
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=36d8bdf75a93190e5669b9d1d95994e13e15ba1d <aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f \|\| >=36d8bdf75a93190e5669b9d1d95994e13e15ba1d <0bdd6121c8dd5f1764efe701ce26bb8e15acb172 \|\| >=36d8bdf75a93190e5669b9d1d95994e13e15ba1d <ad4ebae5dbc2d47b544aa54f03c12490065be08a \|\| >=36d8bdf75a93190e5669b9d1d95994e13e15ba1d <048029ba1c793f8cabc4ad5eea765da01903f8f1	aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f, 0bdd6121c8dd5f1764efe701ce26bb8e15acb172, ad4ebae5dbc2d47b544aa54f03c12490065be08a, 048029ba1c793f8cabc4ad5eea765da01903f8f1
Linux/Linuxgeneric	6.7	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 25, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 25, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEM_PERCPU for percpu kptr stores map_kptr_match_type() treats perm_flags as the set of register type flags that a kptr field permits. Adding MEM_PERCPU to that set for BPF_KPTR_PERCPU does not require the source register to carry it, however. The subset test consequently accepts both a plain bpf_obj_new() allocation and a referenced kernel pointer into a __percpu_kptr map field. Loads from the field are always marked MEM_PERCPU. Consumers then treat the stored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer helpers relocate it, and map teardown selects the per-CPU free path. A plain allocation can therefore provide an arbitrary kernel read/write, while a kernel pointer can be relocated into an invalid address or sent through a missing destructor. Require the source MEM_PERCPU flag to match the destination field kind. This preserves valid bpf_percpu_obj_new() stores and rejects both the program-BTF and kernel-BTF variants.

Quoted source text, attributed separately from HOL analysis.