CVE-2026-98034 (GCVE-0-2026-98034)
Vulnerability from cvelistv5
Published
2026-09-25 10:23
Modified
2026-10-21 12:54
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTR_TO_BTF_ID. Call mark_chain_precision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.
References
Impacted products
Vendor Product Version
Linux Linux Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45
Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45
Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45
Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45
Version: 61df10c7799e27807ad5e459eec9d77cddf8bf45
Version: b5a8069835e5236824a84281592d29f859b33153
Version: 5.18.18   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4",
              "status": "affected",
              "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
              "versionType": "git"
            },
            {
              "lessThan": "b8b98d3d37908402ff63515fa4d7574235436ea8",
              "status": "affected",
              "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
              "versionType": "git"
            },
            {
              "lessThan": "bb667eb575c906f24c707986541a99424c5b07ea",
              "status": "affected",
              "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
              "versionType": "git"
            },
            {
              "lessThan": "86168208737bdd267d92d855d453d1d2f840df19",
              "status": "affected",
              "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
              "versionType": "git"
            },
            {
              "lessThan": "ecdc5043794c9184aa8e6c814603899479c46b35",
              "status": "affected",
              "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b5a8069835e5236824a84281592d29f859b33153",
              "versionType": "git"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.18",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.114",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.114",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark NULL kptr stores precise\n\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\n\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\n\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:54:08.478Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8b98d3d37908402ff63515fa4d7574235436ea8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19"
        },
        {
          "url": "https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"
        }
      ],
      "title": "bpf: Mark NULL kptr stores precise",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98034",
    "datePublished": "2026-09-25T10:23:49.352Z",
    "dateReserved": "2026-09-25T10:19:56.070Z",
    "dateUpdated": "2026-10-21T12:54:08.478Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.