CVE-2026-52938: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.2.6-1 - Compensating control
In the Linux kernel BPF socket storage code, add a NULL check for smap in bpf_sk_storage_clone(), and pass the validated smap directly to diag_get() instead of reading it internally; apply the same validated-map handling to bpf_sk_storage_diag_put() and bpf_sk_storage_diag_put_all().
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52938?
The severity of CVE-2026-52938 has been rated as risk 26.
How do I fix CVE-2026-52938?
To fix CVE-2026-52938, update your Linux kernel to the version that includes the patched code for this vulnerability.
What systems are impacted by CVE-2026-52938?
CVE-2026-52938 impacts systems running affected versions of the Linux kernel with the BPF (Berkeley Packet Filter) functionality.
What type of vulnerability is CVE-2026-52938?
CVE-2026-52938 is classified as a Null Pointer Dereference vulnerability within the Linux kernel.
When was CVE-2026-52938 published?
CVE-2026-52938 was published on June 24, 2026.