CVE-2026-98040

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark the zero register precise for a register-form NULL check

check_cond_jmp_op() accepts "if rA <op> rB" as a NULL check for a

nullable pointer rA when rB is a scalar known to be zero,

lifts PTR_MAYBE_NULL from rA in the corresponding branch and does not

mark rB precise. Consider the following program:

r0 = bpf_get_prandom_u32();

r6 = 1; /* the r6 == 0 path is explored first */

if (r0 == 0) goto 1f;

r6 = 0;

1:

r0 = bpf_map_lookup_elem(map, &0); /* absent, NULL at runtime */

if (r0 == r6) goto 2f; /* taken as a NULL check for r0 */

*(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */

2:

return 0;

The r6 == 0 path is explored first and the dereference is accepted.

The r6 == 1 path is pruned at the checkpoint recorded for (1),

so the comparison is never verified with a non-zero r6. At runtime a

failed lookup returns NULL, NULL != 1 takes the non-NULL edge an

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References