---
id: CVE-2026-98039
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Require MEM_PERCPU for percpu kptr stores

  map_kptr_match_type() treats perm_flags as the set of register type flags
  that a kptr field permits
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Require MEM_PERCPU for percpu kptr stores

  map_kptr_match_type() treats perm_flags as the set of register type flags
  that a kptr field permits. Adding MEM_PERCPU t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 36d8bdf75a93190e5669b9d1d95994e13e15ba1d <
    aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f
  - >-
    Linux >= 36d8bdf75a93190e5669b9d1d95994e13e15ba1d <
    0bdd6121c8dd5f1764efe701ce26bb8e15acb172
  - >-
    Linux >= 36d8bdf75a93190e5669b9d1d95994e13e15ba1d <
    ad4ebae5dbc2d47b544aa54f03c12490065be08a
  - >-
    Linux >= 36d8bdf75a93190e5669b9d1d95994e13e15ba1d <
    048029ba1c793f8cabc4ad5eea765da01903f8f1
  - Linux 6.7
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:32.663'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98039'
references:
  - url: 'https://git.kernel.org/stable/c/048029ba1c793f8cabc4ad5eea765da01903f8f1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0bdd6121c8dd5f1764efe701ce26bb8e15acb172'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/aaa9cf7707d1c5c0d2ca9d40c8b71652ac1c3c3f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ad4ebae5dbc2d47b544aa54f03c12490065be08a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.850Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Require MEM_PERCPU for percpu kptr stores

map_kptr_match_type() treats perm_flags as the set of register type flags
that a kptr field permits. Adding MEM_PERCPU to that set for
BPF_KPTR_PERCPU does not require the source register to carry it, however.
The subset test consequently accepts both a plain bpf_obj_new() allocation
and a referenced kernel pointer into a __percpu_kptr map field.

Loads from the field are always marked MEM_PERCPU. Consumers then treat the
stored value as the cookie returned by bpf_percpu_obj_new(): per-CPU pointer
helpers relocate it, and map teardown selects the per-CPU free path. A plain
allocation can therefore provide an arbitrary kernel read/write, while a
kernel pointer can be relocated into an invalid address or sent through a
missing destructor.

Require the source MEM_PERCPU flag to match the destination field kind.
This preserves valid bpf_percpu_obj_new() stores and rejects both the
program-BTF and kernel-BTF variants.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.