CVE-2026-98034bpf: Mark NULL kptr stores precise
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTR_TO_BTF_ID. Call mark_chain_precision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 61df10c7799e27807ad5e459eec9d77cddf8bf45 before bb667eb575c906f24c707986541a99424c5b07ea; from 61df10c7799e27807ad5e459eec9d77cddf8bf45 before 86168208737bdd267d92d855d453d1d2f840df19; from 61df10c7799e27807ad5e459eec9d77cddf8bf45 before ecdc5043794c9184aa8e6c814603899479c46b35; b5a8069835e5236824a84281592d29f859b33153; from 5.18.18 before 5.19 | CNA record |
References
- https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea
- https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19
- https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.