All vulnerabilities
CVE-2026-98034

Linux: bpf: Mark NULL kptr stores precise

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4Also 86168208737bdd267d92d855d453d1d2f840df19, 5.19CVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

  • 86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4LinuxCVE List
  • 86168208737bdd267d92d855d453d1d2f840df19LinuxCVE List
  • 5.19LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark NULL kptr stores precise

check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise.

A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTR_TO_BTF_ID.

Call mark_chain_precision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.

Text from CVE List

Affected versions 14

  • Linuxaffected: 61df10c7799e27807ad5e459eec9d77cddf8bf45 before 86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4CVE List
  • Linuxaffected: 61df10c7799e27807ad5e459eec9d77cddf8bf45 before b8b98d3d37908402ff63515fa4d7574235436ea8CVE List
  • Linuxaffected: 61df10c7799e27807ad5e459eec9d77cddf8bf45 before bb667eb575c906f24c707986541a99424c5b07eaCVE List
  • Linuxaffected: 61df10c7799e27807ad5e459eec9d77cddf8bf45 before 86168208737bdd267d92d855d453d1d2f840df19CVE List
  • Linuxaffected: 61df10c7799e27807ad5e459eec9d77cddf8bf45 before ecdc5043794c9184aa8e6c814603899479c46b35CVE List
  • Linuxaffected: b5a8069835e5236824a84281592d29f859b33153CVE List
  • Linuxaffected: 5.18.18 before 5.19CVE List
  • Linuxaffected: 5.19CVE List
  • Linuxunaffected: all versions before 5.19CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.114 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5