All vulnerabilities
CVE-2026-98019

Linux: bpf: mark a NULL call argument precise

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in627089c278df58749f25686c6a3caf7e181b5951Also 69a9ad004ccf5d45e534c7d503f47f643abe64b7, 1a3a10b030c96ea88868ccc060a16827c01eaa5aCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 627089c278df58749f25686c6a3caf7e181b5951LinuxCVE List
  • 69a9ad004ccf5d45e534c7d503f47f643abe64b7LinuxCVE List
  • 1a3a10b030c96ea88868ccc060a16827c01eaa5aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: mark a NULL call argument precise

check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.

check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.

Grouping these two into one patch, as they share the same fixes tag.

Text from CVE List

Affected versions 12

  • Linuxaffected: b5dc0163d8fd78e64a7e21f309cf932fda34353e before febbb66e682d8328f7c5bcbdd5e4291abab2e858CVE List
  • Linuxaffected: b5dc0163d8fd78e64a7e21f309cf932fda34353e before 627089c278df58749f25686c6a3caf7e181b5951CVE List
  • Linuxaffected: b5dc0163d8fd78e64a7e21f309cf932fda34353e before b1fe6379e401b8ce0f561cb4d84af2b70b4343c3CVE List
  • Linuxaffected: b5dc0163d8fd78e64a7e21f309cf932fda34353e before 69a9ad004ccf5d45e534c7d503f47f643abe64b7CVE List
  • Linuxaffected: b5dc0163d8fd78e64a7e21f309cf932fda34353e before 1a3a10b030c96ea88868ccc060a16827c01eaa5aCVE List
  • Linuxaffected: 5.3CVE List
  • Linuxunaffected: all versions before 5.3CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5