CVE-2026-98063: bpf: Fix NULL-ptr-deref in btf_var_show()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL-ptr-deref in btfvarshow()
btfvarshow() calls btftypeidresolve() unconditionally, which dereferences btf->resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf() renders against - since base BTF is not resolved during parsing. btfmodifiershow() guards this with 'if (btf->resolvedids)', but btfvarshow() does not.
A BPF program that passes the typeid of a BTFKINDVAR from the vmlinux BTF to bpfsnprintfbtf() thus NULL-derefs:
KASAN: probably user-memory-access in range [0x46638-0x4663f] RIP: 0010:btfvarshow (kernel/bpf/btf.c:2929) Call Trace: <TASK> btftypeshow (kernel/bpf/btf.c:8259) btftypesnprintfshow (kernel/bpf/btf.c:8329) bpfsnprintfbtf (kernel/trace/bpftrace.c:1047) bpfprogtestrunrawtp (net/bpf/testrun.c:829) sysbpf (kernel/bpf/syscall.c:4804) dosyscall64 (arch/x86/entry/syscall64.c:84) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) </TASK>
Resolve the var's type directly with btftypeskipmodifiers() when resolvedids is NULL, mirroring btfmodifiershow().
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to trigger the crash?
They need to run a BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux BTF to bpf_snprintf_btf(). This causes btf_var_show() to dereference a NULL resolved_ids pointer.
Are systems using the base vmlinux BTF affected?
Yes. The issue specifically affects base BTF such as vmlinux BTF, because base BTF is not resolved during parsing and therefore does not have resolved_ids.
What is the effect of successful exploitation?
The described outcome is a kernel NULL-pointer dereference in btf_var_show(), resulting in a crash.
How is the issue fixed?
The fix resolves the variable type directly with btf_type_skip_modifiers() when resolved_ids is NULL, matching the existing handling in btf_modifier_show().