CVE-2026-93174 is a vulnerability in Linux Kernel
Published on September 17, 2026
bpf: Copy per-CPU map value padding in copy_map_value_long()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Copy per-CPU map value padding in copy_map_value_long()
In kernel, per-CPU map elements are stored with
round_up(map->value_size, 8) bytes. On UAPI lookup paths, it copies the
rounded size for each CPU into a temporary buffer.
However, copy_map_value_long() passes 'map->value_size' to
bpf_obj_memcpy(). When the map has special fields, bpf_obj_memcpy() copies
around those fields with memcpy(), and does not copy the tail padding
between 'map->value_size' and round_up(map->value_size, 8).
The temporary UAPI lookup buffers are allocated without __GFP_ZERO. As a
result, when the per-CPU map's value size is not equal to
round_up(map->value_size, 8), UAPI LOOKUP_ELEM and its variants can return
stale heap contents from that padding to user space. The same issue
applies to bpf_iter for per-CPU maps.
Pass round_up(map->value_size, 8) to bpf_obj_memcpy() from
copy_map_value_long(), so per-CPU maps both with and without special
fields copy the entire per-CPU slot. Remove the now redundant round_up()
from bpf_obj_memcpy()'s long_memcpy path.
Products Associated with CVE-2026-93174
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 448325199f574d33824dbf9121efb03558412966 and below 953e85da53541a8dc3e7ad4e8532f29a34a32eae is affected.
- Version 448325199f574d33824dbf9121efb03558412966 and below 003bf840ed3326bd01396ce7d5b431cef0d371e7 is affected.
- Version 448325199f574d33824dbf9121efb03558412966 and below 5e9f69829835521aa2942d1d14bd0990fbc6991e is affected.
- Version 448325199f574d33824dbf9121efb03558412966 and below ff3f22ed8d2f350b4c24ee26e33daea5f08d58ef is affected.
- Version 448325199f574d33824dbf9121efb03558412966 and below 7cf9cd98cf6f0df3befc167ca6b54c07014d71de is affected.
- Version 6.1 is affected.
- Before 6.1 is unaffected.
- Version 6.6.157, <= 6.6.* is unaffected.
- Version 6.12.110, <= 6.12.* is unaffected.
- Version 6.18.52, <= 6.18.* is unaffected.
- Version 7.2.6, <= 7.2.* is unaffected.
- Version 7.3-rc1, <= * is unaffected.