CVE-2026-98034

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark NULL kptr stores precise

check_map_kptr_access() permits a scalar store into an untrusted kptr

field only when the register is known to contain zero. Unlike other

verifier checks whose outcome depends on a scalar value, it does not mark

that register precise.

A state checkpoint reached with an imprecise zero can therefore prune a

second path that reaches the store with an arbitrary nonzero scalar. The

program can write attacker-controlled bits into the kptr field and load

them back as a PTR_TO_BTF_ID.

Call mark_chain_precision() before accepting a known-zero register. This

forces state equivalence to compare its scalar range and makes the verifier

visit and reject a path carrying a nonzero value.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References