UBUNTU-CVE-2026-98043: Null Pointer Dereference
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull() decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL base, in case of an unbound offset the runtime offset value might still add up to NULL. Consider the followng program: r6 = bpfmaplookupelem(map, &0); / present / if (r6 == 0) return 0; r7 = bpfmaplookupelem(map, &1); / absent, NULL at runtime / r8 = r7; r8 -= r6; / pointer - pointer: unknown scalar, -r6 / r8 <<= 1; r8 >>= 1; / any non-negative offset is accepted by / / checkregsaneoffsetptr() / r6 += r8; / verifier: map value; runtime: zero / if (r7 != r6) return 0; (u8 )(r7 + 0); / r7 is inferred non-NULL, both are zero / At runtime both registers are zero, the comparison is true and the load faults with NULL pointer dereference. Require the offset to be within +-BPFMAXVAROFF in regnotnull().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Update the Linux kernel BPF verifier so reg_not_null() requires an unbounded pointer offset to remain within +-BPF_MAX_VAR_OFF before inferring that the register is non-NULL.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running an affected Ubuntu Linux kernel variant are exposed when they allow a user with local privileges to load or execute a crafted BPF program that reaches the flawed verifier logic. The provided data identifies Ubuntu linux, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-riscv, and linux-gkeop packages.
What does an attacker need to exploit it?
An attacker needs local access and low privileges; no user interaction is required. They must craft BPF pointer arithmetic with an unbounded offset so the verifier incorrectly infers that a runtime NULL pointer is non-NULL.
What is the likely impact of successful exploitation?
The crafted program can cause a NULL pointer dereference when it performs a load through a pointer that is NULL at runtime. The supplied vector indicates availability impact, with no stated confidentiality or integrity impact.