All vulnerabilities
CVE-2026-98063

Linux: bpf: Fix NULL-ptr-deref in btf_var_show()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in5756450c9a702da0efb4a993d0a6766b965736f3Also 5403a383f52fc0905703b488f7c3db4b2447dc58CVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 5756450c9a702da0efb4a993d0a6766b965736f3LinuxCVE List
  • 5403a383f52fc0905703b488f7c3db4b2447dc58LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL-ptr-deref in btf_var_show()

btf_var_show() calls btf_type_id_resolve() unconditionally, which dereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is not resolved during parsing. btf_modifier_show() guards this with 'if (btf->resolved_ids)', but btf_var_show() does not.

A BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux BTF to bpf_snprintf_btf() thus NULL-derefs:

KASAN: probably user-memory-access in range [0x46638-0x4663f] RIP: 0010:btf_var_show (kernel/bpf/btf.c:2929) Call Trace: <TASK> btf_type_show (kernel/bpf/btf.c:8259) btf_type_snprintf_show (kernel/bpf/btf.c:8329) bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047) bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829) __sys_bpf (kernel/bpf/syscall.c:4804) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK>

Resolve the var's type directly with btf_type_skip_modifiers() when resolved_ids is NULL, mirroring btf_modifier_show().

Text from CVE List

Affected versions 18

  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before 5756450c9a702da0efb4a993d0a6766b965736f3CVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before e83fcbe3b5d4a1ffb0569bb7c280358065c6017aCVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2CVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before aec0a9c1579eb9edf534960be592d09481bd7ac3CVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before e472ae0d97865e2021ee668a13eab64013aebf23CVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before ca086264e98108b44fdf53971033811a48defe2bCVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before ea383b3ea56979ce54c8aa88e6ec67164986c401CVE List
  • Linuxaffected: c4d0bfb45068d853a478b9067a95969b1886a30f before 5403a383f52fc0905703b488f7c3db4b2447dc58CVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8