CVE-2026-98065

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject key-less BTF for hash maps

map_check_btf() allows a key-less BTF (btf_key_type_id == 0) only for

maps that have a ->map_check_btf callback, and leaves the actual

decision to that callback. Hash maps used to have no ->map_check_btf,

so a key-less BTF was rejected outright.

That changed when htab and rhtab gained a ->map_check_btf to register a

dtor - htab in commit 1df97a7453ee ("bpf: Register dtor for freeing

special fields") and rhtab in commit 6905f8601298 ("bpf: Allow special

fields in resizable hashtab"). Neither looks at the key, so a key-less

hash map now passes map_check_btf() and gets created. Reading it back

through bpffs feeds the key type_id 0 into btf_type_seq_show();

btf_type_by_id() returns the void type, kind_ops[BTF_KIND_UNKN] is NULL,

and btf_type_show() dereferences it:

RIP: 0010:btf_type_show+0x223/0x2e0 kernel/bpf/btf.c:8232

RSP: 0018:ffffc9000399f868 EFLAGS: 00010206

RAX: dffffc0000

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References