CVE-2026-98376

In the Linux kernel, the following vulnerability has been resolved:

bpf: Use array map meta equal for percpu array inner map replacement

percpu array map ops.map meta equal points to the generic bpf map meta equal(), which does not compare max entries. When a percpu array serves as an inner map, replacing it with one that has fewer max entries bypasses the check. Since percpu array map gen lookup() inlines the original template's index mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds.

Point percpu array map ops.map meta equal to array map meta equal(), which already enforces the max entries equality check.

Add a selftest to verify that replacing a percpu array inner map with a differently-sized one is rejected.