UBUNTU-CVE-2026-98039: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype() treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to carry it, however. The subset test consequently accepts both a plain bpfobjnew() allocation and a referenced kernel pointer into a percpukptr map field. Loads from the field are always marked MEMPERCPU. Consumers then treat the stored value as the cookie returned by bpfpercpuobjnew(): per-CPU pointer helpers relocate it, and map teardown selects the per-CPU free path. A plain allocation can therefore provide an arbitrary kernel read/write, while a kernel pointer can be relocated into an invalid address or sent through a missing destructor. Require the source MEMPERCPU flag to match the destination field kind. This preserves valid bpfpercpuobjnew() stores and rejects both the program-BTF and kernel-BTF variants.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker needs the ability to load and run a BPF program that performs stores into a __percpu_kptr map field. The vulnerable verifier behavior accepts non-per-CPU object allocations and referenced kernel pointers where only per-CPU allocations should be accepted.
What is the potential impact of a successful exploit?
A plain bpf_obj_new() allocation stored in a per-CPU kptr field can lead to arbitrary kernel read and write. A referenced kernel pointer may instead be relocated to an invalid address or be freed through an incorrect path without the required destructor.
Which Ubuntu kernel packages are identified as affected?
The affected software list includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-hwe-edge, and ubuntu/linux-gkeop.
What behavior does the fix enforce?
The fix requires the source pointer's MEM_PERCPU flag to match the destination field type. Valid bpf_percpu_obj_new() stores remain allowed, while invalid program-BTF and kernel-BTF pointer variants are rejected.