Linux Kernel EUVD-2026-48897

The Linux kernel's BPF subsystem supports ARRAY_OF_MAPS map types, where an inner map template can be stamped with BPF_F_INNER_MAP, permitting runtime replacement with a concrete inner array having a different max_entries. During verification, the verifier performs const-key lookup nullness elision: when a constant array index is provably within bounds, it elides the null-pointer check on the returned pointer. The bug is that bounds reasoning uses the template's max_entries rather than the concrete runtime map's max_entries. Since the runtime map may have a larger max_entries, an index the verifier considers out-of-bounds - and therefore nullable - may in fact be valid at runtime, or conversely an index the verifier considers in-bounds may be out-of-bounds for the runtime map, causing a null dereference. The fix (kernel commits 0b92ad64d6e4b, d57db0d975053e, 53040a81ae57c) unconditionally preserves lookup result nullness for maps marked BPF_F_INNER_MAP. The CPE (cpe:2.3:a:linux:linux) confirms the affected product is the mainline Linux kernel, introduced at commit d2102f2f5d75a84dbab6ff890359f0bd4a18ca22 (present since Linux 6.14).