CVE-2026-98034: bpf: Mark NULL kptr stores precise
In the Linux kernel, the following vulnerability has been resolved:
bpf: Mark NULL kptr stores precise
checkmapkptraccess() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise.
A state checkpoint reached with an imprecise zero can therefore prune a second path that reaches the store with an arbitrary nonzero scalar. The program can write attacker-controlled bits into the kptr field and load them back as a PTRTOBTFID.
Call markchainprecision() before accepting a known-zero register. This forces state equivalence to compare its scalar range and makes the verifier visit and reject a path carrying a nonzero value.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
An attacker must be able to load and run a BPF program that reaches an untrusted kptr field store. Exploitation relies on steering verifier state handling so that a store accepted as a known-zero scalar is also reachable with an attacker-controlled nonzero scalar.
What is the security impact if the verifier is bypassed?
The BPF program can write attacker-controlled bits into a kptr field and then load those bits back as a PTR_TO_BTF_ID. The description does not specify the resulting privilege level or downstream impact.
How does the fix prevent exploitation?
The fix calls mark_chain_precision() before accepting a known-zero register for the kptr store. This makes state equivalence compare the scalar range, preventing an imprecise zero state from pruning the path where the scalar is nonzero.