All vulnerabilities
CVE-2026-98037

Linux: bpf: Reject untrusted allocated-object pointers

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in092c2874dc1b2060fa77a465a971acd4fdf87683Also 135d542b97fa93e32c457d49d6e7b33ca7d05bae, 6b1f786ad85a0b63393b76f5e634deab1a73198c and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 092c2874dc1b2060fa77a465a971acd4fdf87683LinuxCVE List
  • 135d542b97fa93e32c457d49d6e7b33ca7d05baeLinuxCVE List
  • 6b1f786ad85a0b63393b76f5e634deab1a73198cLinuxCVE List
  • 7441ee8276641bddaf1cba7bb75ef9c1458ceb3bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject untrusted allocated-object pointers

When the final RCU read-side critical section ends, a local kptr is demoted to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer to an object whose lifetime is no longer protected.

type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with MEM_ALLOC as a live allocated object. In particular, a refcount-only local kptr never carries NON_OWN_REF, so it still passes the bpf_refcount_acquire() argument check after RCU protection ends. The kfunc can then dereference NULL or stale memory.

Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since type_is_non_owning_ref() is based on the same predicate, graph kfunc arguments obey the same live-object requirement. Fault-protected reads of the demoted pointer remain valid: writes are already rejected, and read fixups use bpf_may_fault_on_deref() rather than this predicate.

[ kkd: Rewrote commit log ]

Text from CVE List

Affected versions 10

  • Linuxaffected: 1b12171533a9bb23cf6fba7262b479028b65e1e8 before 092c2874dc1b2060fa77a465a971acd4fdf87683CVE List
  • Linuxaffected: 1b12171533a9bb23cf6fba7262b479028b65e1e8 before 135d542b97fa93e32c457d49d6e7b33ca7d05baeCVE List
  • Linuxaffected: 1b12171533a9bb23cf6fba7262b479028b65e1e8 before 6b1f786ad85a0b63393b76f5e634deab1a73198cCVE List
  • Linuxaffected: 1b12171533a9bb23cf6fba7262b479028b65e1e8 before 7441ee8276641bddaf1cba7bb75ef9c1458ceb3bCVE List
  • Linuxaffected: 6.8CVE List
  • Linuxunaffected: all versions before 6.8CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4