CVE-2026-98033: bpf: Preserve inner map identity in callback frames
In the Linux kernel, the following vulnerability has been resolved:
bpf: Preserve inner map identity in callback frames
Callback frame constructors initialize map-typed argument registers with markregknownzero() and then restore mapptr. This clears mapuid, which is the only field distinguishing inner maps that share an innermapmeta template.
When a timer callback invokes bpfforeachmapelem() on a second inner map, both the saved first map and the second map value can reach the nested callback as the same template with mapuid zero. bpftimerinit() then accepts pairing the timer from the second map with the first map.
The runtime records the first map in the timer without taking a reference. Freeing that map does not find the timer stored in the second map, so a later timer callback dereferences the freed map.
Copy mapuid from the same caller register as mapptr when constructing for-each, timer/workqueue, and task-work callback arguments. The existing identity check can then reject mismatched inner maps while allowing a callback value to be paired with its actual map.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
A BPF program must use callback paths involving inner maps that share an inner_map_meta template, allowing a timer from one inner map to be paired with another. The affected flow includes a timer callback invoking bpf_for_each_map_elem() on a second inner map, followed by freeing the first map while its timer is recorded in the second map.
What is the security impact after the mismatched maps are accepted?
The runtime can retain a pointer to the first map in a timer without taking a reference. Because the timer is stored under the second map, freeing the first map does not locate and cancel that timer, and a later timer callback can dereference freed memory.
Which callback argument types are involved in the fix?
The fix preserves map_uid when constructing callback arguments for for-each, timer/workqueue, and task-work callbacks. This lets the existing identity check distinguish inner maps that use the same template and reject mismatched pairings.