CVE-2026-98588

Что произошло

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sock_map_alloc() only rejects max_entries == 0 and otherwise allows any u32 value. sock_map_free() then walks the sks[] array with a signed int iterator: int i; for (i = 0; i map.max_entries; i++) struct sock **psk = &stab->sks[i]; When a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the allocation of 32 GiB can succeed on large-memory hosts. During free the counter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq and turned into a ~16 GiB negative offset from stab->sks, pointing far below the allocation. The faulting access is an xchg() write in sock_map_free(). Without KASAN, the same out-of-bounds write can fault on an unmapped vmalloc page or corrupt an unrelated allocation if that vmalloc address is populated. On a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that address hits an unmapped shadow page and oopses first: BUG: unable to handle page fault for address: fffff521b59c5a00 RIP: 0010:kasan_check_range+0x107/0x190 Call Trace: sock_map_free+0x93/0x190 map_create+0x68d/0xb30 __sys_bpf+0x21e/0x2e70 Vmcore confirmed stab->map.max_entries == 0xffffffff, stab->sks == 0xffffc911ace2d000, and the faulting address sks + (s64)INT_MIN * 8 exactly at 0xffffc90dace2d000. The same buggy path is reached on the normal close()/bpf_map_free_deferred() path whenever such a map is destroyed. sock_map_alloc() used to bound its allocation size through bpf_map_charge_init(), but the bound was dropped when rlimit-based memory accounting was removed. Reject max_entries > INT_MAX at creation time so the signed iterator in sock_map_free() never sees a value that would overflow. Triggered by syzkaller and reproduced on both a 6.6-based KASAN kernel and the upstream v7.3-rc2 kernel.

Что делать

dpkg-query -W -f='${Package}	${Version}\n'

rpm -qa --qf '%{NAME}\t%{VERSION}-%{RELEASE}\n'

Get-HotFix | Select-Object HotFixID, InstalledOn

Продукты и затронутые версии

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "f4a73f49e256bd835368504462be3b57b03febff",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "c56191af3a578b9cc265fa3bd5fc0752c59c1781",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "909f761868fda329dc69130ef9eb5b5795bcdf00",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "cc70972ddbf0e3398f2f32624d31db78594d50d8",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "cea597519b9ca6d691c98d92460ead8ece2a07af",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "ba7d627dbc67d62df2fa66d7b41e743c3ace0ec8",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "0d2c4f9640501ff57ba0be1f5644a02c29a02fa1",
  "lessThan": "814a81c842bd88f6bd8a4ce550d560df071a5d03",
  "versionType": "git"
}

{
  "status": "affected",
  "version": "5.11"
}

{
  "status": "unaffected",
  "version": "0",
  "lessThan": "5.11",
  "versionType": "semver"
}

{
  "status": "unaffected",
  "version": "5.15.222",
  "versionType": "semver",
  "lessThanOrEqual": "5.15.*"
}

{
  "status": "unaffected",
  "version": "6.1.189",
  "versionType": "semver",
  "lessThanOrEqual": "6.1.*"
}

{
  "status": "unaffected",
  "version": "6.6.158",
  "versionType": "semver",
  "lessThanOrEqual": "6.6.*"
}

{
  "status": "unaffected",
  "version": "6.12.112",
  "versionType": "semver",
  "lessThanOrEqual": "6.12.*"
}

{
  "status": "unaffected",
  "version": "6.18.55",
  "versionType": "semver",
  "lessThanOrEqual": "6.18.*"
}

{
  "status": "unaffected",
  "version": "7.2.9",
  "versionType": "semver",
  "lessThanOrEqual": "7.2.*"
}

{
  "status": "unaffected",
  "version": "7.3",
  "versionType": "original_commit_for_fix",
  "lessThanOrEqual": "*"
}

CVSS: оценки и векторы

Оценка CVSS отсутствует.

Источники и ссылки

{
  "cwes": [],
  "epss": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:46.228815+00:00"
  },
  "title": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.456941+00:00"
  },
  "scores": [],
  "status": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.456941+00:00"
  },
  "affected": [
    "cve"
  ],
  "published": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.456941+00:00"
  },
  "solutions": [],
  "percentile": {
    "source": "epss",
    "received_at": "2026-11-02T21:15:46.228815+00:00"
  },
  "references": [
    "cve"
  ],
  "description": {
    "source": "cve",
    "received_at": "2026-10-28T20:13:06.456941+00:00"
  },
  "workarounds": [],
  "configurations": []
}

Хронология записи

1. Данные обновлены03.11.2026, 00:15
2. Данные обновлены02.11.2026, 00:13
3. Данные обновлены31.10.2026, 12:00
4. Данные обновлены29.10.2026, 12:47
5. Опубликована28.10.2026, 23:13

Личная заметка и статус

Другие CVE того же продукта