CVE-2026-98787: bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch()
bpfmemcachefreercu() uses thiscpuptr() which requires migration to be disabled. All callers of rhtabdeleteelem() disable migration except rhtabmaplookupanddeletebatch(), which calls it under rcureadlock() only.
On CONFIGPREEMPTRCU, rcureadlock() does not disable preemption or migration, so the task can migrate between CPUs during the delete loop, causing thiscpuptr() to trigger:
BUG: using smpprocessorid() in preemptible [00000000] code
Fix by wrapping the delete loop in migratedisable()/migrateenable() in rhtabmaplookupanddeletebatch(), matching the migration protection that the other callers already provide.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In __rhtab_map_lookup_and_delete_batch(), wrap the delete loop with migrate_disable() and migrate_enable() to prevent task migration while using this_cpu_ptr().