CVE-2026-98064

Awaiting Analysis Awaiting Analysis - Queue

NULL-ptr-deref in Linux Kernel BPF

Publication date: 2026-09-25

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btf_modifier_show() resolves the modifier and then calls btf_type_ops(t)->show() unconditionally. For the void type (type_id 0, BTF_KIND_UNKN) kind_ops[] has no entry, so ->show is NULL. A "const void" (a modifier resolving to void) cannot be a map key or value - map_check_btf() rejects it because void has no size - so the map dump path does not reach it. But bpf_snprintf_btf() takes a type_id straight from the BPF program, and passing such a "const void" from the vmlinux BTF NULL-derefs: KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] RIP: 0010:btf_modifier_show (kernel/bpf/btf.c:2914) Call Trace: <TASK> btf_type_show (kernel/bpf/btf.c:8251) btf_type_snprintf_show (kernel/bpf/btf.c:8321) bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047) bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829) __sys_bpf (kernel/bpf/syscall.c:4804) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) </TASK> Fall back to btf_df_show() when the resolved type has no show op; it emits the "<unsupported kind:N>" placeholder already used for kinds like FWD and FUNC. bpf_snprintf_btf() then returns the length as usual.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-14

NVD

CVE-2026-98064

EUVD

EUVD-2026-86717

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a NULL-pointer dereference in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. It occurs when the btf_modifier_show() function tries to access a show operation for a void BTF type, which has no defined operation. This leads to a crash when processing certain BPF programs that reference a void type from the vmlinux BTF.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) subsystem and does not have a direct network-based detection method. It requires kernel-level inspection. Check if your kernel version includes the vulnerable code by examining the BPF-related functions in the kernel. Use commands like 'uname -a' to check kernel version and 'dmesg | grep -i bpf' to look for BPF-related errors.

Impact Analysis

This vulnerability could cause a kernel crash (NULL-pointer dereference) when a BPF program attempts to process a void type. This may lead to denial-of-service conditions, system instability, or potential privilege escalation if exploited maliciously.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue causing a NULL-pointer dereference in BPF type handling, which could lead to system crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest kernel update that includes the fix for this vulnerability. If an update is not immediately available, avoid using BPF programs that may trigger the NULL-ptr-deref issue. Monitor kernel logs for BTF-related errors. Disable or restrict BPF functionality if not required.

Hi! I’m here to help you understand CVE-2026-98064. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70