{"id":"CVE-2026-98787","kind":"vulnerability","aliases":["CVE-2026-98787"],"related":[],"title":"Linux kernel BPF hash map batch delete can trigger a preemption bug","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()\n\nbpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration\nto be disabled. All callers of rhtab_delete_elem() disable migration\nexcept __rhtab_map_lookup_and_delete_batch(), which calls it under\nrcu_read_lock() only.\n\nOn CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or\nmigration, so the task can migrate between CPUs during the delete loop,\ncausing this_cpu_ptr() to trigger:\n\n  BUG: using smp_processor_id() in preemptible [00000000] code\n\nFix by wrapping the delete loop in migrate_disable()/migrate_enable()\nin __rhtab_map_lookup_and_delete_batch(), matching the migration\nprotection that the other callers already provide.","summary":"In the Linux kernel's BPF resizable hash map, batch lookup-and-delete runs under rcu_read_lock() without disabling migration, so a task can move between CPUs while calling a per-CPU pointer. The result is a kernel warning about smp_processor_id() in preemptible code, and the fix wraps the delete loop in migrate_disable()/migrate_enable().","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- unknown","fix":"- Move to a kernel build that includes the fix wrapping the delete loop in migrate_disable()/migrate_enable() in __rhtab_map_lookup_and_delete_batch()\n- Check the kernel version against the distribution's advisory: unknown","status":"open","published_at":"2026-10-18T16:17:32+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:18+00:00","updated_at":"2026-10-25T05:15:18+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:15:18Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a kernel build that includes the fix wrapping the delete loop in migrate_disable()/migrate_enable() in __rhtab_map_lookup_and_delete_batch()\n- Check the kernel version against the distribution's advisory: unknown","reach":"local","title":"Linux kernel BPF hash map batch delete can trigger a preemption bug","impact":"low","summary":"In the Linux kernel's BPF resizable hash map, batch lookup-and-delete runs under rcu_read_lock() without disabling migration, so a task can move between CPUs while calling a per-CPU pointer. The result is a kernel warning about smp_processor_id() in preemptible code, and the fix wraps the delete loop in migrate_disable()/migrate_enable().","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bpf","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel warning from a preemption bug; impact beyond that is unknown","analyst_note":"Find the affected kernel version ranges and whether BPF map operations need privileges, using the NVD entry linked in the sources.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with CONFIG_PREEMPT_RCU that use BPF resizable hash maps with batch lookup-and-delete operations. The sources do not say which kernel versions are affected or whether an unprivileged user can reach the path, so the exposure is unclear.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000642,"input_tokens":3539,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98787':15A,18A '/migrate_enable':86B,195C '00000000':184C 'alreadi':211C 'batch':6A,36B,108C,138C,202C 'bpf':3A,19B,32B,97C,109C 'bug':12A,177C 'cach':111C 'call':57B,140C 'caller':125C,210C 'caus':171C 'code':75B,185C 'config':148C 'cpu':61B,116C,173C 'cpus':55B,166C 'cve':13A,16A 'delet':7A,40B,81B,107C,128C,137C,169C,190C,201C 'disabl':47B,85B,123C,130C,156C,194C 'elem':129C 'except':132C 'fix':78B,98C,186C 'follow':92C 'free':112C 'hash':4A,34B 'host':26B 'id':72B,181C 'kernel':2A,22B,30B,67B,90C 'linux':1A,21B,29B,89C 'linux-kernel':20B 'lock':45B,145C,153C 'lookup':38B,105C,135C,199C 'lookup-and-delet':37B 'loop':82B,170C,191C 'map':5A,35B,104C,134C,198C 'match':203C 'mem':110C 'migrat':48B,84B,100C,120C,131C,159C,164C,193C,205C 'miss':99C 'move':53B 'per':60B 'per-cpu':59B 'pointer':62B 'preempt':149C 'preemptibl':74B,183C 'preemption':11A,157C 'processor':71B,180C 'protect':101C,206C 'provid':212C 'ptr':117C,174C 'rcu':43B,113C,143C,150C,151C 'read':44B,144C,152C 'requir':119C 'resiz':33B 'resolv':96C 'result':64B 'rhtab':103C,127C,133C,197C 'run':41B 'runtim':23B 'self':25B 'self-host':24B 'smp':70B,179C 'task':51B,162C 'trigger':9A,176C 'use':114C,178C 'vulner':93C 'warn':68B 'without':46B 'wrap':79B,188C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with CONFIG_PREEMPT_RCU that use BPF resizable hash maps with batch lookup-and-delete operations. The sources do not say which kernel versions are affected or whether an unprivileged user can reach the path, so the exposure is unclear.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98787","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98787","severity":null,"published_at":"2026-10-18T16:17:32+00:00","modified_at":"2026-10-19T10:19:42+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}