CVE-2026-97420 Linux CVE debrief

Who should care

Linux kernel developers and administrators responsible for configuring and securing Linux systems, particularly those using BPF programs, should review and apply the fix, monitor for exploitation attempts, and verify system configurations and BPF program usage to prevent potential out-of-bounds access and denial of service.

Why it matters

A vulnerability in the Linux kernel's bpf subsystem can lead to out-of-bounds access and potential denial of service. Linux kernel developers and administrators should review and apply the fix, monitor for exploitation attempts, and verify system configurations and BPF program usage.

• Potential for out-of-bounds reads and slab corruption
• Possible denial of service (DoS) via exploitation
• Need for verification of system configurations and BPF program usage
• Potential for elevation of privileges

Technical summary

The Linux kernel's bpf subsystem is vulnerable to out-of-bounds access when replacing sysctl values. The bpf_sysctl_set_new_value function does not NUL-terminate the replacement buffer, allowing for slab-out-of-bounds reads. A fix has been applied by appending a NUL terminator to the replaced value. The vulnerability was verified through a QEMU x86_64 guest booted with KASAN while exercising the sysctl replacement path with a cgroup/sysctl BPF program targeting `/proc/sys/net/core/flow_limit_cpu_bitmap`. The pre-fix kernel reported a

Defensive priority

High

Recommended defensive actions

• Review and apply the fix for the Linux kernel
• Monitor for potential exploitation attempts
• Verify system configurations and BPF program usage
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a description of the issue and a fix. Reproduction of the issue was achieved in a QEMU x86_64 guest booted with KASAN while exercising the sysctl replacement path with a cgroup/sysctl BPF program. The reproducer targets `/proc/sys/net/core/flow_limit_cpu_bitmap`, fills the original user write buffer with non-zero bytes, and overrides the sysctl value so the replacement buffer lacks a terminating NUL. Under that setup, the pre-fix kernel reported a slab-out-of

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.