CVE-2026-98037
Received Received - Intake

BPF Pointer Validation Flaw in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer to an object whose lifetime is no longer protected. type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with MEM_ALLOC as a live allocated object. In particular, a refcount-only local kptr never carries NON_OWN_REF, so it still passes the bpf_refcount_acquire() argument check after RCU protection ends. The kfunc can then dereference NULL or stale memory. Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since type_is_non_owning_ref() is based on the same predicate, graph kfunc arguments obey the same live-object requirement. Fault-protected reads of the demoted pointer remain valid: writes are already rejected, and read fixups use bpf_may_fault_on_deref() rather than this predicate. [ kkd: Rewrote commit log ]

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-98037
EUVD
EUVD-2026-86690

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in how BPF (Berkeley Packet Filter) handles pointers to allocated objects. When an RCU read-side critical section ends, a local pointer is demoted to an untrusted state but retains memory allocation permissions. The system incorrectly treats these untrusted pointers as valid allocated objects, allowing potential dereferencing of NULL or stale memory, which could lead to crashes or security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) component. Detection requires checking kernel logs for BPF-related errors or crashes. Use commands like dmesg | grep -i bpf or journalctl -k | grep -i bpf to inspect kernel logs for BPF-related issues. If custom BPF programs are in use, audit them for untrusted pointer usage.

Impact Analysis

This vulnerability could allow local attackers to cause a denial of service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems running vulnerable Linux kernel versions where BPF is used, potentially impacting security and stability.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability is patched. Avoid using untrusted BPF programs or kfuncs that handle pointers with MEM_ALLOC. Restrict BPF program loading to trusted users to prevent exploitation. Monitor kernel logs for signs of exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98037. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart