CVE-2026-98376

Executive Summary

CVE-2026-98376 is a security vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem involving improper validation of inner map replacement for per-CPU array maps. A local attacker with the ability to load and manipulate eBPF maps can replace a per-CPU array inner map with one that has fewer max_entries, bypassing a size-equality check and enabling out-of-bounds access to the pptrs[] array. The result is potential kernel memory corruption, privilege escalation, or system crash. No public exploit, PoC, or CISA KEV listing exists at the time of this report, and the vulnerability is currently UNPATCHED according to available data.

Technical Analysis

The vulnerability resides in the Linux kernel's eBPF map infrastructure, specifically in the handling of per-CPU array maps used as inner maps within a map-of-maps (inner map) construct.

eBPF maps are kernel-resident data structures accessible to eBPF programs. A "map of maps" allows an eBPF program to select among multiple inner maps at runtime. When an inner map is created, the kernel validates its properties against the outer map's template via a callback known as map_meta_equal.

In the affected code, percpu_array_map_ops.map_meta_equal pointed to the generic bpf_map_meta_equal(). That generic comparison function does not compare the max_entries field. Consequently, when a per-CPU array map served as an inner map, it could be replaced with another per-CPU array map having fewer max_entries without triggering a rejection.

The second half of the flaw is in the interaction with JIT compilation. percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate value. Because the replacement map is accepted despite differing in size, the JIT-compiled lookup routine retains the original, larger index_mask. A lookup performed on the replacement (smaller) map can therefore compute an index that exceeds the replacement map's actual bounds, leading to an out-of-bounds access on pptrs[].

In plain terms: the kernel trusts a cached template attribute (index_mask) that no longer matches the replaced map's real allocation. The mismatch converts a bounds-check assumption into a memory-safety failure. The description explicitly attributes the root cause to the missing max_entries equality check and the stale JIT-immediate index_mask.

The fix redirects percpu_array_map_ops.map_meta_equal to array_map_meta_equal(), which already enforces max_entries equality. A selftest was added to ensure that replacing a per-CPU array inner map with a differently-sized one is rejected.

Attack surface: the eBPF map management interface. Triggering the flaw requires the ability to create a map-of-maps with a per-CPU array inner map and then replace that inner map with a smaller per-CPU array map — operations typically gated by CAP_BPF/CAP_SYS_ADMIN or available to unprivileged users where unprivileged BPF is enabled, depending on kernel configuration. The CWE is mapped to CWE-787 (Out-of-bounds Write), consistent with the described pptrs[] out-of-bounds access.

Exploitation Scenarios

No public PoC or exploit code is available. The following attack chain is inferred strictly from the NVD description and vulnerability class; specific implementation details beyond those in the description are not asserted.

1. Reconnaissance / target identification: An attacker with local code execution on a Linux host determines whether the kernel exposes eBPF map functionality and whether the required capabilities (or unprivileged BPF) are available. Identification focuses on kernels that support eBPF map-of-maps with per-CPU array inner maps and that contain the flawed percpu_array_map_ops.map_meta_equal assignment.

2. Triggering the specific flaw class: The attacker creates an outer map whose inner map template is a per-CPU array map, then replaces the inner map with a per-CPU array map that has fewer max_entries. Because the vulnerable comparison does not check max_entries, the replacement is accepted. The replacement is the mechanism-level trigger — the flaw class is an improper input/size validation (CWE-787's precondition) in map metadata comparison.

3. Payload / execution method (vulnerability-class level): With the replacement map installed, an eBPF program performing a lookup on the inner map can cause the JIT-inlined index_mask from the original template to produce an index beyond the replacement map's bounds, resulting in an out-of-bounds access on pptrs[]. The attacker's payload is the eBPF program and the map operations themselves; no network payload or user-space memory-corruption primitive is described.

4. Post-exploitation impact: Out-of-bounds access to pptrs[] in kernel context can corrupt kernel memory or leak data, potentially enabling privilege escalation or causing a kernel crash (denial of service). The exact primitives obtainable depend on runtime layout and are not specified in the description.

No public exploit is available; the attack chain above is inferred from the vulnerability class and the explicit mechanisms named in the NVD description.

Impact Assessment

The impact is high because the flaw occurs in kernel memory management. A successful out-of-bounds access can lead to kernel memory corruption, information disclosure, privilege escalation, or system instability/crash — the classic eBPF local privilege-escalation profile. The CVSS score and vector are N/A / not provided by the source data; no subscores can be reported. Conservatively, the vulnerability class (locals-only, kernel memory corruption) maps to high confidentiality, integrity, and availability impact with a scope change across the kernel/user boundary.

Blast radius: any Linux system running an affected kernel with eBPF enabled. Exploitation requires local access and, depending on configuration, elevated capabilities or unprivileged BPF availability. No affected version list or OSV package data was provided, so the exact version window is unknown.

Detection Guidance

Sigma Rule

title: Potential eBPF Per-CPU Array Inner Map Replacement Abuse (CVE-2026-98376)
id: 9a6f1c2e-5b7d-4e3a-8f10-2c9e7b4d6a01
status: experimental
description: Detects BPF-related privilege or map operations that may indicate abuse of per-CPU array inner map replacement.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98376
author: valtersit.com
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_syscall:
    type: SYSCALL
    syscall|contains:
      - 'bpf'
  selection_keys:
    key|contains:
      - 'BPF_MAP_CREATE'
      - 'BPF_MAP_UPDATE_ELEM'
      - 'BPF_PROG_LOAD'
  condition: selection_syscall and selection_keys
falsepositives:
  - Legitimate eBPF-based observability, networking, or security tooling
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.98376

YARA Rule

rule CVE_2026_98376_BPF_Percpu_Array_Replacement
{
    meta:
        description = "Detects artifacts referencing percpu array inner map replacement abuse (CVE-2026-98376)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98376"
        date = "2026-01-01"
    strings:
        $s1 = "percpu_array_map_gen_lookup" ascii wide
        $s2 = "percpu_array_map_ops" ascii wide
        $s3 = "map_meta_equal" ascii wide
        $s4 = "index_mask" ascii wide
        $s5 = "bpf_map_meta_equal" ascii wide
    condition:
        uint32(0) == 0x464c457f and 2 of ($s*)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-98376 Possible eBPF per-CPU array inner map replacement abuse (local BPF map manipulation)"; flow:to_server; content:"|b7 00 00 00 00 00 00 00|"; depth:1; classtype:attempted-admin; sid:202698376; rev:1; metadata:cve CVE-2026-98376, attack_target Local, created_at 2026_01_01; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-98376;)

Elastic Detection

process where host.os.type == "linux" and event.category == "process" and event.type == "start" and
process.name in ("bpftool", "unshare") and
process.args : ("*map*", "*inner*", "*percpu*")

Splunk SPL Query

index=linux sourcetype=auditd OR sourcetype=sysmon_linux (syscall=bpf OR process_name="bpftool")
| search ("BPF_MAP_CREATE" OR "BPF_PROG_LOAD" OR "percpu" OR "inner_map" OR "map_update_elem")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, user, command
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="linux,ebpf,cve-2026-98376,">
  <rule id="202698376" level="8">
    <decoded_as>auditd</decoded_as>
    <field name="audit.syscall">bpf</field>
    <match>BPF_MAP_CREATE|BPF_PROG_LOAD|percpu|inner_map</match>
    <description>CVE-2026-98376: Possible eBPF per-CPU array inner map replacement abuse detected.</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

• Restrict eBPF functionality to trusted users only. Where possible, disable unprivileged BPF (e.g., set kernel.unprivileged_bpf_disabled to a restrictive value) to prevent low-privileged local users from exercising map-management operations.
• Limit CAP_BPF and CAP_SYS_ADMIN to trusted processes and administrators.
• Enforce strict local-access controls (least privilege, no untrusted code execution) to reduce the local attack surface.
• Monitor BPF map and program-load syscalls for anomalous per-CPU array inner map replacement activity.

2. Patch / upgrade steps:

• No patch is available per tracked sources. Apply the upstream kernel fix when released: update percpu_array_map_ops.map_meta_equal to point to array_map_meta_equal() (which enforces max_entries equality), and apply the associated selftest.
• Track the Linux kernel stable/security mailing lists and distro advisories for the commit and backport relevant to your kernel version.
• There is no vendor-supplied fix or workaround listed in the provided data.

3. Long-term hardening:

• Keep kernels patched and subscribed to distro security advisories.
• Maintain BPF hardening configurations consistent with your threat model; use LSM/BPF LSM and seccomp profiles to constrain BPF use.
• Conduct eBPF map-of-maps usage audits in multi-tenant or container environments where local users share the kernel.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-98376
• CWE-787: https://cwe.mitre.org/data/definitions/787.html
• MITRE ATT&CK T1068: https://attack.mitre.org/techniques/T1068/
• Linux kernel BPF documentation: https://www.kernel.org/doc/html/latest/bpf/
• CISA Known Exploited Vulnerabilities Catalog (not listed for CVE-2026-98376; verify current status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-98376 in the provided data.