CVE-2026-93174: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-93174 is a kernel memory disclosure vulnerability in the Linux kernel's eBPF subsystem, specifically in the copy_map_value_long() function handling per-CPU BPF maps. When a per-CPU map contains special fields, the function incorrectly passes map->value_size instead of round_up(map->value_size, 8) to bpf_obj_memcpy(), causing uninitialized heap padding bytes to be returned to user space via UAPI LOOKUP_ELEM operations and bpf_iter iterations. The vulnerability affects Linux kernel versions from 6.1 up to (but not including) the fixed stable releases. Patched versions include 6.6.157, 6.12.110, 6.18.52, 7.2.6, and 7.3-rc1. The CVSS base score has not yet been formally assigned; Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is an information exposure through uninitialized memory (CWE-200 / CWE-908). In the Linux kernel, per-CPU BPF map elements are stored in slots of round_up(map->value_size, 8) bytes, but copy_map_value_long() only passes map->value_size to bpf_obj_memcpy(). When the map has special fields (e.g., timers, spin locks), bpf_obj_memcpy() uses memcpy() to copy around those fields and skips the tail padding between map->value_size and the rounded-up slot size. Because the temporary UAPI lookup buffers are allocated without __GFP_ZERO, the uninitialized padding bytes — which may contain stale heap contents — are returned to user space. The fix passes round_up(map->value_size, 8) to bpf_obj_memcpy() from copy_map_value_long(), ensuring the entire per-CPU slot is always copied (GitHub Advisory).

Successful exploitation allows a user with access to the eBPF UAPI (e.g., via BPF_MAP_LOOKUP_ELEM syscall) to read uninitialized kernel heap memory from the padding region of per-CPU BPF map slots. This is a confidentiality impact — the leaked bytes may contain sensitive kernel data such as pointers, cryptographic material, or other process data previously stored in that heap region. Integrity and availability are not directly affected. The vulnerability is limited to per-CPU maps that have special fields and whose value_size is not already a multiple of 8 (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is 0.0, reflecting very low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the ability to invoke the bpf() syscall with BPF_MAP_LOOKUP_ELEM on a per-CPU map with special fields, which typically requires either elevated privileges or a system with unprivileged BPF enabled (GitHub Advisory).

Update to a patched Linux kernel version: 6.6.157, 6.12.110, 6.18.52, 7.2.6, or 7.3-rc1 and later. The fix is applied via upstream commits to the stable kernel trees (e.g., 953e85da, 003bf840, 5e9f6982, ff3f22ed, 7cf9cd98). As a short-term workaround on systems where unprivileged BPF is not required, restrict access to the bpf() syscall by setting kernel.unprivileged_bpf_disabled=1 via sysctl, which limits BPF map access to privileged users only (GitHub Advisory, Feedly).