CVE-2026-98134

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: check_cond_jmp_op(): properly infer if register is null

Nicholas Carlini reported a bug when verifier can incorrectly infer

that a pointer is non-null. The bug occurs when two pointers are

compared and one of them has a type w/o PTR_MAYBE_NULL flag,

but which allows a value to be NULL at runtime.

Here is an example:

// `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED

// `a` is 0 at runtime.

// `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL

void *a = bpf_rdonly_cast(0, 0);

int *b = bpf_map_lookup_elem(...);

if (a == b)

*b = 42; // verifier does not catch null pointer dereference

This happens because of a special case in check_cond_jmp_op(),

which attempts to strip PTR_MAYBE_NULL flags from pointer types,

when processing comparisons like `rA == rB`, if either rA or rB can't

be null.

The non-null property is derived based on the absence of

PTR_MAYBE_NULL flag on rA's or rB's type. But that is not suff

/// Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// Affected products

/// References