Linux Kernel Per-CPU Map Value Padding Vulnerability - CVE-2026-93174
Summary
DEBIAN-CVE-2026-93174: In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copy_map_value_long() In kernel, per-CPU map elements are stored with round_up(map->value_size, 8) bytes. Affects linux versions 6.1.106-1 – 7.2~rc7-1~exp1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It manages system resources, facilitates communication between hardware and applications, and ensures system stability. This vulnerability specifically affects the handling of per-CPU map elements, which are crucial for optimizing performance in multi-core systems. The issue arises from improper memory handling, leading to potential exposure of sensitive data.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the handling of per-CPU map values. The function copy_map_value_long() incorrectly passes the size of the map value to bpf_obj_memcpy(), which fails to account for necessary padding. This oversight can result in stale heap contents being returned to user space during UAPI lookup operations, potentially exposing sensitive information. The vulnerability affects both UAPI LOOKUP_ELEM and bpf_iter for per-CPU maps, making it critical to address.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel package as described above.
Conclusion
The CVE-2026-93174 vulnerability in the Linux kernel poses a significant risk by potentially exposing sensitive data through improper handling of per-CPU map values. It is crucial for users to update their systems to the patched version to mitigate this risk effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2026-93174 is a vulnerability in the Linux kernel related to the handling of per-CPU map values, which can lead to the exposure of stale data.
If exploited, this vulnerability could allow unauthorized access to sensitive information stored in memory, potentially compromising system security.
The vulnerability affects Debian-based systems running the Linux kernel, specifically versions prior to the patch release addressing CVE-2026-93174.
You can use Vulert, which monitors open-source vulnerabilities in your software. By analyzing your manifest file, such as package-lock.json, Vulert can alert you to any vulnerabilities, including CVE-2026-93174.
Currently, there are no known workarounds. The recommended action is to update the Linux kernel to the patched version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
