CVE-2026-98043: bpf: Don't infer non-NULL from a pointer with an unbounded offset
In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't infer non-NULL from a pointer with an unbounded offset
regnotnull() decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL base, in case of an unbound offset the runtime offset value might still add up to NULL. Consider the followng program:
r6 = bpfmaplookupelem(map, &0); / present / if (r6 == 0) return 0; r7 = bpfmaplookupelem(map, &1); / absent, NULL at runtime / r8 = r7; r8 -= r6; / pointer - pointer: unknown scalar, -r6 / r8 <<= 1; r8 >>= 1; / any non-negative offset is accepted by / / checkregsaneoffsetptr() / r6 += r8; / verifier: map value; runtime: zero / if (r7 != r6) return 0; (u8 )(r7 + 0); / r7 is inferred non-NULL, both are zero /
At runtime both registers are zero, the comparison is true and the load faults with NULL pointer dereference.
Require the offset to be within +-BPFMAXVAROFF in regnotnull().
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the NULL pointer dereference?
An attacker needs to load a BPF program that performs pointer arithmetic with an unbounded offset and causes the verifier to infer that a NULL-capable pointer is non-NULL. The demonstrated path relies on map lookups where one lookup returns a valid value and another returns NULL at runtime.
What is the practical impact if exploitation succeeds?
The affected BPF program can pass verifier checks and then dereference a NULL pointer at runtime. This causes a NULL pointer dereference fault in the kernel.
What change resolves the verifier flaw?
The fix requires the offset to remain within plus or minus BPF_MAX_VAR_OFF before reg_not_null() treats a pointer as non-NULL. This prevents an unbounded arithmetic offset from being used to establish non-NULL status.