Linux Kernel CVE-2026-98150

Requires: (1) a Linux host whose possible-CPU mask is SPARSE/non-contiguous, i.e. CPU IDs with gaps such as 0,2-3 (typical of arm64/embedded boards or virtualized guests with CPU device-tree holes; ordinary contiguous 0..N-1 x86 systems are NOT vulnerable because num_possible_cpus() then equals nr_cpu_ids); (2) the kernel supporting the new BPF_F_CPU flag (introduced around Linux 7.0); (3) local ability to call bpf() with BPF privilege - CAP_BPF, or an environment where unprivileged BPF is enabled; and (4) creation of a BPF_MAP_TYPE_PERCPU_ARRAY on which an update/lookup is issued with BPF_F_CPU and a CPU ID that is below num_possible_cpus() but absent from the possible mask. Limiting factors: no remote vector (local only), the sparse-mask requirement excludes most mainstream server/desktop deployments, and the feature is very new so only recent kernels are in scope.

This is a high-CVSS-but-low-real-risk issue. The NVD base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) rests on a full C:H/I:H/A:H impact triad that is not supported by the technical detail: the crash signature is 'Unable to handle kernel paging request' inside __pi_memcpy_generic → bpf_percpu_array_update, i.e. an out-of-bounds/invalid per-CPU memory access on an absent CPU. This is crash/corruption-dominant with no described confidentiality path, so C:H/I:H is overstated - a defensible re-score is C:N/I:L/A:H (~5.0). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no signal of active or imminent exploitation. Crucially, the vulnerability only manifests on systems whose possible-CPU mask is SPARSE/non-contiguous (the reporter's example is an arm64 QEMU guest with a device-tree hole giving mask 0,2-3); on ordinary contiguous 0..N-1 systems (typical x86 servers/desktops) num_possible_cpus() equals nr_cpu_ids and the flawed check never accepts an invalid ID, so those hosts are not affected. Combined with the requirement for the brand-new BPF_F_CPU flag and CAP_BPF/unprivileged-BPF access, real-world exploitability is narrow. The CVSS AV:L and PR:L are consistent with the description (local bpf() syscall, requires BPF privilege); AC:H is appropriate given the sparse-CPU-mask precondition.

On a Linux host with a non-contiguous possible-CPU mask (e.g. an arm64/embedded or virtualized guest with a CPU device-tree hole), a local user holding CAP_BPF (or where unprivileged BPF is enabled) creates a BPF_MAP_TYPE_PERCPU_ARRAY and issues an update via raw bpf() with BPF_F_CPU set and a CPU ID that is within num_possible_cpus() but absent from the possible mask. The kernel accepts the invalid ID and memcpys into an unallocated per-CPU region, triggering a paging fault and kernel crash (DoS). No public exploit code was identified at time of analysis.