CVE-2026-98019

bpf: mark a NULL call argument precise

State: Published
Severity: Not scored
Published: Sep 25, 2026
Updated: Oct 21, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: mark a NULL call argument precise

check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.

check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.

Grouping these two into one patch, as they share the same fixes tag.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b5dc0163d8fd78e64a7e21f309cf932fda34353e to before febbb66e682d8328f7c5bcbdd5e4291abab2e858Affected b5dc0163d8fd78e64a7e21f309cf932fda34353e to before 627089c278df58749f25686c6a3caf7e181b5951Affected b5dc0163d8fd78e64a7e21f309cf932fda34353e to before b1fe6379e401b8ce0f561cb4d84af2b70b4343c3Affected b5dc0163d8fd78e64a7e21f309cf932fda34353e to before 69a9ad004ccf5d45e534c7d503f47f643abe64b7Affected b5dc0163d8fd78e64a7e21f309cf932fda34353e to before 1a3a10b030c96ea88868ccc060a16827c01eaa5aAffected
LinuxLinux	5.3Affected before 5.3Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.7 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

b5dc0163d8fd78e64a7e21f309cf932fda34353e to before febbb66e682d8328f7c5bcbdd5e4291abab2e858Affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e to before 627089c278df58749f25686c6a3caf7e181b5951Affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e to before b1fe6379e401b8ce0f561cb4d84af2b70b4343c3Affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e to before 69a9ad004ccf5d45e534c7d503f47f643abe64b7Affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e to before 1a3a10b030c96ea88868ccc060a16827c01eaa5aAffected

LinuxLinux

5.3Affected
before 5.3Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.7 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.