CVE-2026-98134: bpf: check_cond_jmp_op(): properly infer if register is null
Published Sep 25, 2026
·Updated
bpf: checkcondjmpop(): properly infer if register is null
Affected Software
3 affected components
Linux Linux kernel
Linux Linux kernel>=6.2<7.2.7
Linux Linux kernel=7.3-rc1
Remediation
Event History
Sep 25, 2026
CVE Published
via MITRE·10:36 AM
Data Sourced
via MITRE·10:36 AM
Description
Data Sourced
via NVD·11:17 AM
RemedyDescriptionSeverityWeaknessAffected Software
Sep 28, 2026
Data Sourced
via Microsoft·06:40 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What BPF program pattern can trigger the verifier error?
The issue arises when a BPF program compares two pointers and one pointer type lacks PTR_MAYBE_NULL even though its runtime value can be NULL. A comparison with a nullable pointer, such as a map lookup result, can then cause the verifier to incorrectly treat the nullable pointer as non-NULL.
2
What can happen after the verifier makes the incorrect inference?
The verifier can accept a dereference of a pointer that is NULL at runtime. The provided example shows a nullable map-value pointer being dereferenced after an equality comparison that the verifier incorrectly considers sufficient to prove it is non-NULL.