CVE-2026-93112bpf: Require a BPF cpumask for bpf_cpumask_populate()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpf_cpumask_populate() bpf_cpumask_populate() writes to its destination with bitmap_copy(), but the destination is typed as struct cpumask *. That allows the verifier to accept borrowed cpumask pointers returned by read-only kfuncs, such as scx_bpf_get_online_cpumask(), as a writable destination. Make the destination a struct bpf_cpumask * so populate follows the same ownership rule as the other mutating cpumask kfuncs. Query kfuncs continue to accept const struct cpumask * inputs.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 18, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 950ad93df2fce70445e655ed2e74f5c1a8653ab2 builds before 0cfc9348a045da64955af2dd6902e66dfc7d6469; from 950ad93df2fce70445e655ed2e74f5c1a8653ab2 before b7e2a5c6519adc73be55c3de2cb545e095a0fbc5; from 950ad93df2fce70445e655ed2e74f5c1a8653ab2 before 8740156ad33be5071b588b594c55f279457f667c | CNA record |
References
- https://git.kernel.org/stable/c/0cfc9348a045da64955af2dd6902e66dfc7d6469
- https://git.kernel.org/stable/c/b7e2a5c6519adc73be55c3de2cb545e095a0fbc5
- https://git.kernel.org/stable/c/8740156ad33be5071b588b594c55f279457f667c
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.