{"id":"CVE-2026-93174","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Copy per-CPU map value padding in copy_map_value_long()\n\nIn kernel, per-CPU map elements are stored with\nround_up(map->value_size, 8) bytes","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Copy per-CPU map value padding in copy_map_value_long()\n\nIn kernel, per-CPU map elements are stored with\nround_up(map->value_size, 8) bytes. On UAPI lookup paths, …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 448325199f574d33824dbf9121efb03558412966 < 953e85da53541a8dc3e7ad4e8532f29a34a32eae","Linux >= 448325199f574d33824dbf9121efb03558412966 < 003bf840ed3326bd01396ce7d5b431cef0d371e7","Linux >= 448325199f574d33824dbf9121efb03558412966 < 5e9f69829835521aa2942d1d14bd0990fbc6991e","Linux >= 448325199f574d33824dbf9121efb03558412966 < ff3f22ed8d2f350b4c24ee26e33daea5f08d58ef","Linux >= 448325199f574d33824dbf9121efb03558412966 < 7cf9cd98cf6f0df3befc167ca6b54c07014d71de","Linux 6.1"],"published":"2026-09-17","updated":"2026-09-17","sourceUpdated":"2026-09-17T17:18:13.167","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93174","references":[{"url":"https://git.kernel.org/stable/c/003bf840ed3326bd01396ce7d5b431cef0d371e7","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/5e9f69829835521aa2942d1d14bd0990fbc6991e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7cf9cd98cf6f0df3befc167ca6b54c07014d71de","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/953e85da53541a8dc3e7ad4e8532f29a34a32eae","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ff3f22ed8d2f350b4c24ee26e33daea5f08d58ef","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-17T16:21:47.730Z","epss":0.00168,"epssPercentile":0.06461,"slug":"CVE-2026-93174","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Copy per-CPU map value padding in copy_map_value_long()\n\nIn kernel, per-CPU map elements are stored with\nround_up(map->value_size, 8) bytes. On UAPI lookup paths, it copies the\nrounded size for each CPU into a temporary buffer.\n\nHowever, copy_map_value_long() passes 'map->value_size' to\nbpf_obj_memcpy(). When the map has special fields, bpf_obj_memcpy() copies\naround those fields with memcpy(), and does not copy the tail padding\nbetween 'map->value_size' and round_up(map->value_size, 8).\n\nThe temporary UAPI lookup buffers are allocated without __GFP_ZERO. As a\nresult, when the per-CPU map's value size is not equal to\nround_up(map->value_size, 8), UAPI LOOKUP_ELEM and its variants can return\nstale heap contents from that padding to user space. The same issue\napplies to bpf_iter for per-CPU maps.\n\nPass round_up(map->value_size, 8) to bpf_obj_memcpy() from\ncopy_map_value_long(), so per-CPU maps both with and without special\nfields copy the entire per-CPU slot. Remove the now redundant round_up()\nfrom bpf_obj_memcpy()'s long_memcpy path.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}