CVE-2026-98063

Awaiting Analysis Awaiting Analysis - Queue

NULL-ptr-deref in Linux Kernel BPF

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btf_var_show() btf_var_show() calls btf_type_id_resolve() unconditionally, which dereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is not resolved during parsing. btf_modifier_show() guards this with 'if (btf->resolved_ids)', but btf_var_show() does not. A BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux BTF to bpf_snprintf_btf() thus NULL-derefs: KASAN: probably user-memory-access in range [0x46638-0x4663f] RIP: 0010:btf_var_show (kernel/bpf/btf.c:2929) Call Trace: <TASK> btf_type_show (kernel/bpf/btf.c:8259) btf_type_snprintf_show (kernel/bpf/btf.c:8329) bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047) bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829) __sys_bpf (kernel/bpf/syscall.c:4804) do_syscall_64 (arch/x86/entry/syscall_64.c:84) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Resolve the var's type directly with btf_type_skip_modifiers() when resolved_ids is NULL, mirroring btf_modifier_show().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98063

EUVD

EUVD-2026-86716

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a NULL-pointer dereference vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The issue occurs in the btf_var_show() function which unconditionally calls btf_type_id_resolve(), attempting to access btf->resolved_ids that is NULL for base BTF like vmlinux BTF. This leads to a kernel crash when a BPF program passes a type_id from vmlinux BTF to bpf_snprintf_btf().

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and requires kernel-level inspection. Detection involves checking kernel logs for NULL pointer dereference errors related to btf_var_show() or bpf_snprintf_btf(). Use commands like 'dmesg | grep -i "NULL-ptr-deref"' or 'journalctl -k | grep -i "btf_var_show"' to search for relevant errors.

Impact Analysis

This vulnerability could cause system crashes (kernel panic) when specific BPF operations are performed. An attacker with BPF program access might trigger this flaw to cause denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability is a NULL-pointer dereference in the Linux kernel's BPF subsystem. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory safety issues.

Mitigation Strategies

Apply the latest kernel patch that resolves this issue. If a patch is not yet available, avoid using BPF programs that interact with vmlinux BTF type IDs. Monitor vendor advisories for updates and consider temporarily disabling BPF-related features if the risk is high.

Hi! I’m here to help you understand CVE-2026-98063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70