CVE-2026-98065: bpf: Reject key-less BTF for hash maps
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject key-less BTF for hash maps
mapcheckbtf() allows a key-less BTF (btfkeytypeid == 0) only for maps that have a ->mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no ->mapcheckbtf, so a key-less BTF was rejected outright.
That changed when htab and rhtab gained a ->mapcheckbtf to register a dtor - htab in commit 1df97a7453ee ("bpf: Register dtor for freeing special fields") and rhtab in commit 6905f8601298 ("bpf: Allow special fields in resizable hashtab"). Neither looks at the key, so a key-less hash map now passes mapcheckbtf() and gets created. Reading it back through bpffs feeds the key typeid 0 into btftypeseqshow(); btftypebyid() returns the void type, kindops[BTFKINDUNKN] is NULL, and btftypeshow() dereferences it:
RIP: 0010:btftypeshow+0x223/0x2e0 kernel/bpf/btf.c:8232 RSP: 0018:ffffc9000399f868 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000028 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc9000399f970 R11: 0000000000000001 R12: ffffffff9b96b140 R13: ffffc9000399f8e0 R14: ffff88803d393c00 R15: 0000000000000003 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 000000003d213000 CR4: 0000000000352ef0 DR0: 0000000039ae8f55 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> btftypeseqshowflags+0xca/0x120 kernel/bpf/btf.c:8250 htabmapseqshowelem+0x12e/0x350 kernel/bpf/hashtab.c:1669 mapseqshow+0x13d/0x1e0 kernel/bpf/inode.c:293 traverse.part.0.constprop.0+0x107/0x650 fs/seqfile.c:112 traverse fs/seqfile.c:99 [inline] seqreaditer+0x93f/0x1270 fs/seqfile.c:196 seqread+0x344/0x4d0 fs/seqfile.c:163 vfsread+0x1e4/0xb40 fs/readwrite.c:572 ksyspread64 fs/readwrite.c:764 [inline] dosyspread64 fs/readwrite.c:772 [inline] sesyspread64 fs/readwrite.c:769 [inline] x64syspread64+0x1eb/0x250 fs/readwrite.c:769 dosyscallx64 arch/x86/entry/syscall64.c:61 [inline] dosyscall64+0x123/0x790 arch/x86/entry/syscall64.c:84 entrySYSCALL64afterhwframe+0x77/0x7f
Reject a key-less BTF in htabmapcheckbtf() and rhtabmapcheckbtf(), restoring the previous behavior.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the crash?
An attacker must be able to create a hash map with key-less BTF and have it accepted by the kernel. The crash is triggered when that map is read back through bpffs, causing the invalid key type ID to reach BTF type display code.
Which hash map variants are implicated?
The issue affects hash maps whose map_check_btf callback was added to register a destructor, specifically htab and rhtab. Those callbacks did not validate the key, allowing a key-less BTF hash map to be created.
How can I determine whether a system has encountered this issue?
A kernel crash trace may show btf_type_show() at kernel/bpf/btf.c:8232, with btf_type_by_id() resolving key type ID 0 to the void type. The triggering operation is reading the affected map through bpffs.