CVE-2026-93174

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where per-CPU map elements are stored using a rounded size, but the copy map value long() function passes only the map->value size to bpf obj memcpy(). When maps contain special fields, the tail padding between the actual value size and the rounded size is not copied. Because temporary UAPI lookup buffers are allocated without GFP ZERO (a flag that ensures memory is initialized to zero), the UAPI LOOKUP ELEM and its variants, as well as bpf iter for per-CPU maps, may return stale heap contents from this padding to user space.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.