CVE-2026-98019: bpf: mark a NULL call argument precise
In the Linux kernel, the following vulnerability has been resolved:
bpf: mark a NULL call argument precise
checkfuncarg() allows bpfregisterisnull() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.
checkhelpercall() enforces second parameter of the bpfgetlocalstorage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.
Grouping these two into one patch, as they share the same fixes tag.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue is in BPF verifier handling of nullable helper-call arguments and the second argument to bpf_get_local_storage(). Exploitation would require a BPF program path that reaches these checks with a scalar register whose value has not been marked precise.
How can I determine whether my kernel includes the fix?
Check whether your kernel source or vendor patch set includes either stable commit 69a9ad004ccf5d45e534c7d503f47f643abe64b7 or 1a3a10b030c96ea88868ccc060a16827c01eaa5a. The provided information does not identify affected or fixed kernel version numbers.