UBUNTU-CVE-2026-98150: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags() currently compares that ID with numpossiblecpus(), which is the number of possible CPUs rather than a bound on CPU IDs. On an arm64 QEMU guest with a CPU device-tree hole, the possible CPU mask was 0,2-3. A userspace program using raw bpf() syscalls creates a BPFMAPTYPEPERCPUARRAY and performs update and lookup operations for each CPU by setting BPFFCPU and the CPU ID in the flags. With the old check, CPU 1 is incorrectly accepted while valid CPU 3 is rejected with -ERANGE. The CPU 1 update then reaches the per-CPU map access path and triggers: Unable to handle kernel paging request at virtual address ... pc : pimemcpygeneric+0x5c/0x22c lr : bpfpercpuarrayupdate+0x2dc/0x2e8 Call trace: pimemcpygeneric bpfmapupdatevalue mapupdateelem sysbpf Check the CPU ID against nrcpuids and cpupossible() instead. This rejects CPU IDs outside the valid range and CPUs absent from the possible mask, while allowing valid sparse CPU IDs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are potentially exposed when their possible-CPU mask has sparse CPU IDs, such as a CPU numbering hole. The described reproduction uses an arm64 QEMU guest whose possible CPUs are 0, 2, and 3.
What access does an attacker need to trigger the flaw?
An attacker needs local access with permission to use raw bpf() syscalls and to create and operate on a BPF_MAP_TYPE_PERCPU_ARRAY. They must issue map update or lookup operations with BPF_F_CPU and a CPU ID that is incorrectly accepted by the old validation.
How can I tell whether my system has the vulnerable CPU layout?
Check whether the system's possible CPU mask contains non-contiguous CPU IDs. The affected validation can accept an absent ID below the number of possible CPUs while rejecting a valid higher sparse ID; for example, with possible CPUs 0,2-3, CPU 1 is accepted and CPU 3 is rejected.
What is the effect of a successful trigger?
The invalid CPU ID can reach the per-CPU map access path during an update and cause a kernel paging request, as shown by the reported call trace in bpf_percpu_array_update. The supplied severity vector rates impacts to confidentiality, integrity, and availability as high.