CVE-2026-98034
Received Received - Intake

BPF Verifier NULL kptr Store Precision Issue

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise. A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTR_TO_BTF_ID. Call mark_chain_precision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98034
EUVD
EUVD-2026-86687

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the BPF (Berkeley Packet Filter) verifier. The issue allows a register with a known zero value to store arbitrary bits into a kptr (kernel pointer) field without proper validation. This can lead to incorrect state pruning in the verifier, enabling an attacker to write controlled data into kernel memory and later read it back as a valid pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) component and requires kernel-level inspection. Detection involves checking kernel logs for BPF-related errors or verifying if your kernel version includes the fix. Use commands like 'uname -r' to check kernel version and 'dmesg | grep -i bpf' to look for BPF-related messages.

Impact Analysis

This vulnerability could allow an attacker with local access to execute arbitrary code in the kernel, leading to privilege escalation, system compromise, or denial of service. It primarily affects systems running vulnerable Linux kernel versions with BPF enabled.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling BPF functionality temporarily if it is not required on your system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98034. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart