{"id":"CVE-2026-98588","kind":"vulnerability","aliases":["CVE-2026-98588"],"related":[],"title":"Linux kernel: oversized SOCKMAP size lets a BPF map free write out of bounds","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc\n\nsock_map_alloc() only rejects max_entries == 0 and otherwise allows any\nu32 value.  sock_map_free() then walks the sks[] array with a signed int\niterator:\n\n\tint i;\n\tfor (i = 0; i < stab->map.max_entries; i++)\n\t\tstruct sock **psk = &stab->sks[i];\n\nWhen a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the\nallocation of 32 GiB can succeed on large-memory hosts.  During free the\ncounter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq\nand turned into a ~16 GiB negative offset from stab->sks, pointing far\nbelow the allocation.\n\nThe faulting access is an xchg() write in sock_map_free().  Without\nKASAN, the same out-of-bounds write can fault on an unmapped vmalloc page\nor corrupt an unrelated allocation if that vmalloc address is populated.\nOn a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that\naddress hits an unmapped shadow page and oopses first:\n\n  BUG: unable to handle page fault for address: fffff521b59c5a00\n  RIP: 0010:kasan_check_range+0x107/0x190\n  Call Trace:\n   sock_map_free+0x93/0x190\n   map_create+0x68d/0xb30\n   __sys_bpf+0x21e/0x2e70\n\nVmcore confirmed stab->map.max_entries == 0xffffffff, stab->sks ==\n0xffffc911ace2d000, and the faulting address sks + (s64)INT_MIN * 8\nexactly at 0xffffc90dace2d000.  The same buggy path is reached on the\nnormal close()/bpf_map_free_deferred() path whenever such a map is\ndestroyed.\n\nsock_map_alloc() used to bound its allocation size through\nbpf_map_charge_init(), but the bound was dropped when rlimit-based memory\naccounting was removed.  Reject max_entries > INT_MAX at creation time so\nthe signed iterator in sock_map_free() never sees a value that would\noverflow.\n\nTriggered by syzkaller and reproduced on both a 6.6-based KASAN kernel\nand the upstream v7.3-rc2 kernel.","summary":"Creating a SOCKMAP with max_entries above INT_MAX makes the kernel's free routine loop with a wrapped signed counter, writing far outside the allocated array. The sources do not say whether this gives an attacker code execution or only a crash.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","linux-kernel","self-hosted"],"not_affected_if":["kernel-with-fix","unprivileged-bpf-disabled"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel builds in the kernel.org stable changelog for the upstream commit that adds the max_entries > INT_MAX check in sock_map_alloc.\n- Check whether unprivileged BPF is allowed with `sysctl kernel.unprivileged_bpf_disabled`; unknown whether this is the only requirement to trigger it.","fix":"- Update the Linux kernel to a stable release that includes the sock_map_alloc max_entries > INT_MAX check (exact version unknown from the sources).\n- Until patched, consider restricting unprivileged BPF with `sysctl -w kernel.unprivileged_bpf_disabled=2`.","status":"open","published_at":"2026-10-18T16:17:11+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:22:59+00:00","updated_at":"2026-10-25T05:22:59+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T05:22:59Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a stable release that includes the sock_map_alloc max_entries > INT_MAX check (exact version unknown from the sources).\n- Until patched, consider restricting unprivileged BPF with `sysctl -w kernel.unprivileged_bpf_disabled=2`.","reach":"local","title":"Linux kernel: oversized SOCKMAP size lets a BPF map free write out of bounds","impact":"high","summary":"Creating a SOCKMAP with max_entries above INT_MAX makes the kernel's free routine loop with a wrapped signed counter, writing far outside the allocated array. The sources do not say whether this gives an attacker code execution or only a crash.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","bpf"],"confidence":0.6,"needs_auth":"unknown","worst_case":"out-of-bounds kernel memory write; possible crash or memory corruption","analyst_note":"Confirm the fixed kernel versions and whether unprivileged users can reach bpf(BPF_MAP_CREATE) by default, using the kernel.org stable commit for this fix.","how_to_check":"- Run `uname -r` and compare against the fixed kernel builds in the kernel.org stable changelog for the upstream commit that adds the max_entries > INT_MAX check in sock_map_alloc.\n- Check whether unprivileged BPF is allowed with `sysctl kernel.unprivileged_bpf_disabled`; unknown whether this is the only requirement to trigger it.","needs_analyst":true,"not_affected_if":["unprivileged-bpf-disabled","kernel-with-fix"],"who_is_affected":"Hosts running a Linux kernel without the upstream fix that can create BPF SOCKMAP maps, which includes any system where a local process can use the bpf() syscall. The sources reproduce it on a KASAN 6.6-based kernel and upstream v7.3-rc2, and say it needs large-memory hosts for the 32 GiB allocation to succeed. Systems with unprivileged BPF disabled or restricted are likely less exposed, but the sources do not confirm this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000799,"input_tokens":4054,"output_tokens":788,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':266C,273C,277C,281C '-2026':16A,19A '-98588':17A,20A '/bpf_map_free_deferred':314C '0':100C,124C '0010':262C '0x80000000':164C '0xffffc90dace2d000':303C '0xffffc911ace2d000':291C '0xffffffff':144C,288C '16':179C '32':150C '6.6':380C '8':300C 'access':193C 'account':346C 'address':226C,243C,259C,295C 'alloc':54B,92C,95C,148C,190C,222C,324C,329C 'allow':103C 'array':55B,114C 'attack':65B 'base':344C,381C 'bound':14A,209C,327C,338C 'bpf':8A,21B,82C,280C,332C 'bug':252C 'buggi':306C 'call':268C 'charg':334C 'check':240C,264C 'close':313C 'code':66B 'config':234C 'confirm':284C 'corrupt':219C 'counter':49B,162C 'crash':71B 'creat':29B,140C,276C 'creation':355C 'cve':15A,18A 'destroy':321C 'drop':340C 'entri':34B,86C,99C,128C,143C,287C,351C 'exact':301C 'execut':67B 'extend':172C 'far':51B,187C 'fault':192C,212C,257C,294C 'fffff521b59c5a00':260C 'first':251C 'follow':77C 'free':10A,42B,109C,160C,201C,272C,364C 'gib':151C,180C 'give':63B 'handl':255C 'hit':244C 'host':28B,158C 'infrastructur':22B 'init':335C 'int':36B,87C,118C,120C,167C,298C,352C 'iter':119C,360C 'kasan':203C,231C,235C,263C,382C 'kernel':2A,25B,40B,75C,232C,383C,388C 'larg':156C 'large-memori':155C 'let':6A 'linux':1A,24B,74C 'linux-kernel':23B 'loop':44B 'make':38B 'map':9A,91C,94C,108C,200C,271C,275C,319C,323C,333C,363C 'map.max':127C,286C 'max':33B,37B,85C,88C,98C,142C,146C,350C,353C 'memori':157C,345C 'min':168C,299C 'movslq':174C 'negat':181C 'never':365C 'normal':312C 'offset':182C 'oops':250C 'otherwis':102C 'out-of-bound':206C 'outsid':52B 'overflow':371C 'overs':3A 'page':217C,248C,256C 'path':307C,315C 'point':186C 'popul':228C 'psk':132C 'rang':265C 'reach':163C,309C 'reject':84C,97C,349C 'remov':348C 'reproduc':376C 'resolv':81C 'rip':261C 'rlimit':343C 'rlimit-bas':342C 'routin':43B 's64':297C 'say':60B 'see':366C 'self':27B 'self-host':26B 'shadow':239C,247C 'sign':48B,117C,171C,359C 'sign-extend':170C 'size':5A,330C 'sks':113C,134C,185C,290C,296C 'sock':90C,93C,107C,131C,199C,270C,322C,362C 'sockmap':4A,31B,83C,138C 'sourc':57B 'stab':126C,133C,184C,285C,289C 'struct':130C 'succeed':153C 'sys':279C 'syzkal':374C 'time':356C 'trace':269C 'trigger':372C 'turn':176C 'u32':105C 'uint':145C 'unabl':253C 'unmap':215C,246C 'unrel':221C 'upstream':386C 'use':325C 'v7.3-rc2':387C 'valu':106C,368C 'vmalloc':216C,225C,236C 'vmcore':283C 'vulner':78C 'walk':111C 'whenev':316C 'whether':61B 'without':202C 'would':370C 'wrap':47B,165C 'write':11A,50B,197C,210C 'x107/0x190':267C 'x21e/0x2e70':282C 'x68d/0xb30':278C 'x93/0x190':274C 'xchg':196C 'y':237C","nicknames":[],"mitigations":[],"who_affected":"Hosts running a Linux kernel without the upstream fix that can create BPF SOCKMAP maps, which includes any system where a local process can use the bpf() syscall. The sources reproduce it on a KASAN 6.6-based kernel and upstream v7.3-rc2, and say it needs large-memory hosts for the 32 GiB allocation to succeed. Systems with unprivileged BPF disabled or restricted are likely less exposed, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98588","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98588","severity":null,"published_at":"2026-10-18T16:17:11+00:00","modified_at":"2026-10-19T10:19:19+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}