CVE-2026-53032

bpf: Fix NULL deref in map_kptr_match_type for scalar regs

State: Published
Severity: Not scored
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL deref in map_kptr_match_type for scalar regs

Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL.

Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 520454e839710c327808c2fcc98e28cee77355fcAffected ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 0a36c1f72888bca0237295a4da19cd91821a90beAffected ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 6982653ce5f119982aa58f1af58e7bfbebf39252Affected ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before da1d615ce49a47986a8864e2371a26e97861085cAffected ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 4d0a375887ab4d49e4da1ff10f9606cab8f7c3adAffected af3d2e0f3a54e67806959d161e613457772babc5Affected 4782968e0d631b0d8944dcfd4bf8fb49be087101Affected 6.4.16 to before 6.5Affected 6.5.3 to before 6.6Affected
LinuxLinux	6.6Affected before 6.6Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 520454e839710c327808c2fcc98e28cee77355fcAffected
ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 0a36c1f72888bca0237295a4da19cd91821a90beAffected
ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 6982653ce5f119982aa58f1af58e7bfbebf39252Affected
ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before da1d615ce49a47986a8864e2371a26e97861085cAffected
ab6c637ad0276e42f8acabcbc64932a6d346dab3 to before 4d0a375887ab4d49e4da1ff10f9606cab8f7c3adAffected
af3d2e0f3a54e67806959d161e613457772babc5Affected
4782968e0d631b0d8944dcfd4bf8fb49be087101Affected
6.4.16 to before 6.5Affected
6.5.3 to before 6.6Affected

LinuxLinux

6.6Affected
before 6.6Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.