CVE-2026-98149 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of Linux-based systems, and security teams responsible for patching and vulnerability management should assess exposure and apply patches. These stakeholders should verify affected versions and prioritize patching for critical systems. They should also monitor Linux kernel updates for further information and review compensating controls for exposed systems.

Why it matters

A Linux kernel vulnerability affects BPF per-CPU map updates with sparse CPU IDs, potentially causing system instability. Linux kernel maintainers and administrators should assess exposure and apply patches.

• Incorrect per-CPU values due to flawed update indexing
• Out-of-bounds reads from the update buffer
• Potential for system instability or crashes
• Need for verification of affected versions and patch application

Technical summary

The Linux kernel's BPF subsystem has a vulnerability in per-CPU map update indexing with sparse CPU IDs. This issue can cause incorrect per-CPU values and out-of-bounds reads. The problem is resolved in the updated kernel code, which advances the source offset once for each possible CPU. The update paths iterate over possible CPUs, ensuring correct per-CPU values. BPF_F_ALL_CPUS continues to use the same value for every CPU. The corresponding lookup paths already use a dense offset while iterating over possible CPUs.

Defensive priority

Assess exposure and apply patches for Linux kernel systems using BPF.

Recommended defensive actions

• Assess Linux kernel systems for BPF usage and apply patches
• Verify system exposure and prioritize patching for critical systems
• Monitor Linux kernel updates for further information
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. However, the scope of affected systems and versions requires verification from official Linux kernel sources. Users should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. The Linux kernel maintainers and administrators should verify the affected versions and apply patches. Evidence of patch application and system verification should be documented.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.