CVE-2026-98787

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix missing migration protection in rhtab map lookup and delete batch()

bpf mem cache free rcu() uses this cpu ptr() which requires migration to be disabled. All callers of rhtab delete elem() disable migration except rhtab map lookup and delete batch(), which calls it under rcu read lock() only.

On CONFIG PREEMPT RCU, rcu read lock() does not disable preemption or migration, so the task can migrate between CPUs during the delete loop, causing this cpu ptr() to trigger:

BUG: using smp processor id() in preemptible [00000000] code

Fix by wrapping the delete loop in migrate disable()/migrate enable() in rhtab map lookup and delete batch(), matching the migration protection that the other callers already provide.