CVE-2026-98019

Received Received - Intake

BPF NULL Argument Handling Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-10-15

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98019

EUVD

EUVD-2026-86672

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of NULL arguments in BPF (Berkeley Packet Filter) functions. The issue allows a checkpoint created on a path with a nullable argument to prune against arbitrary scalar values, potentially leading to incorrect behavior or security bypasses.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if the kernel version contains the vulnerable code paths. Commands like 'dmesg | grep -i bpf' or 'uname -a' to check kernel version may help identify exposure.

Impact Analysis

This vulnerability could allow an attacker to manipulate BPF programs to bypass security checks or cause unexpected behavior in the kernel. If exploited, it may lead to privilege escalation, denial of service, or unauthorized access to system resources.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a technical flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. Compliance impacts would depend on how the vulnerability is exploited in a specific system or application context, which is not detailed in the provided CVE information.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the bpf_register_is_null() and check_helper_call() issues described in CVE-2026-98019.

Hi! I’m here to help you understand CVE-2026-98019. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70