---
id: "CVE-2026-98787"
kind: "vulnerability"
aliases: ["CVE-2026-98787"]
title: "Linux kernel BPF hash map batch delete can trigger a preemption bug"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["bpf", "linux-kernel", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-10-18T16:17:32+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:15:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98787", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel BPF hash map batch delete can trigger a preemption bug

In the Linux kernel's BPF resizable hash map, batch lookup-and-delete runs under rcu_read_lock() without disabling migration, so a task can move between CPUs while calling a per-CPU pointer. The result is a kernel warning about smp_processor_id() in preemptible code, and the fix wraps the delete loop in migrate_disable()/migrate_enable().

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- Move to a kernel build that includes the fix wrapping the delete loop in migrate_disable()/migrate_enable() in __rhtab_map_lookup_and_delete_batch()
- Check the kernel version against the distribution's advisory: unknown

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98787

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

bpf_mem_cache_free_rcu() uses this_cpu_ptr() which requires migration
to be disabled. All callers of rhtab_delete_elem() disable migration
except __rhtab_map_lookup_and_delete_batch(), which calls it under
rcu_read_lock() only.

On CONFIG_PREEMPT_RCU, rcu_read_lock() does not disable preemption or
migration, so the task can migrate between CPUs during the delete loop,
causing this_cpu_ptr() to trigger:

  BUG: using smp_processor_id() in preemptible [00000000] code

Fix by wrapping the delete loop in migrate_disable()/migrate_enable()
in __rhtab_map_lookup_and_delete_batch(), matching the migration
protection that the other callers already provide.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_