CVE-2026-98034

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98034", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.070Z", "datePublished": "2026-09-25T10:23:49.352Z", "dateUpdated": "2026-10-21T12:54:08.478Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:54:08.478Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark NULL kptr stores precise\n\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\n\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\n\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "lessThan": "86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4", "status": "affected", "versionType": "git"}, {"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "lessThan": "b8b98d3d37908402ff63515fa4d7574235436ea8", "status": "affected", "versionType": "git"}, {"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "lessThan": "bb667eb575c906f24c707986541a99424c5b07ea", "status": "affected", "versionType": "git"}, {"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "lessThan": "86168208737bdd267d92d855d453d1d2f840df19", "status": "affected", "versionType": "git"}, {"version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "lessThan": "ecdc5043794c9184aa8e6c814603899479c46b35", "status": "affected", "versionType": "git"}, {"version": "b5a8069835e5236824a84281592d29f859b33153", "status": "affected", "versionType": "git"}, {"version": "5.18.18", "lessThan": "5.19", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "5.19", "status": "affected"}, {"version": "0", "lessThan": "5.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4"}, {"url": "https://git.kernel.org/stable/c/b8b98d3d37908402ff63515fa4d7574235436ea8"}, {"url": "https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea"}, {"url": "https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19"}, {"url": "https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}], "title": "bpf: Mark NULL kptr stores precise", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4", "status": "affected", "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "versionType": "git"}, {"lessThan": "b8b98d3d37908402ff63515fa4d7574235436ea8", "status": "affected", "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "versionType": "git"}, {"lessThan": "bb667eb575c906f24c707986541a99424c5b07ea", "status": "affected", "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "versionType": "git"}, {"lessThan": "86168208737bdd267d92d855d453d1d2f840df19", "status": "affected", "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "versionType": "git"}, {"lessThan": "ecdc5043794c9184aa8e6c814603899479c46b35", "status": "affected", "version": "61df10c7799e27807ad5e459eec9d77cddf8bf45", "versionType": "git"}, {"status": "affected", "version": "b5a8069835e5236824a84281592d29f859b33153", "versionType": "git"}, {"lessThan": "5.19", "status": "affected", "version": "5.18.18", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.19"}, {"lessThan": "5.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark NULL kptr stores precise\n\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\n\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\n\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value."}], "id": "CVE-2026-98034", "lastModified": "2026-10-21T13:21:19.607", "metrics": {}, "published": "2026-09-25T11:17:32.123", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86168208737bdd267d92d855d453d1d2f840df19"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86a3171c90bfc35a54e9d83cd197ca0d72d2f4e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b8b98d3d37908402ff63515fa4d7574235436ea8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bb667eb575c906f24c707986541a99424c5b07ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ecdc5043794c9184aa8e6c814603899479c46b35"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Mark NULL kptr stores precise", "id": "2541225", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541225"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-843", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Mark NULL kptr stores precise\ncheck_map_kptr_access() permits a scalar store into an untrusted kptr\nfield only when the register is known to contain zero. Unlike other\nverifier checks whose outcome depends on a scalar value, it does not mark\nthat register precise.\nA state checkpoint reached with an imprecise zero can therefore prune a\nsecond path that reaches the store with an arbitrary nonzero scalar. The\nprogram can write attacker-controlled bits into the kptr field and load\nthem back as a PTR_TO_BTF_ID.\nCall mark_chain_precision() before accepting a known-zero register. This\nforces state equivalence to compare its scalar range and makes the verifier\nvisit and reject a path carrying a nonzero value.", "A flaw was found in the Linux kernel's eBPF (Extended Berkeley Packet Filter) verifier. This flaw allows a local user to achieve privilege escalation by submitting a specially crafted eBPF program. Because the verifier fails to properly track register precision when writing to kernel pointers, it prematurely prunes and accepts unsafe execution paths, enabling the program to manipulate kernel memory and gain elevated privileges."], "name": "CVE-2026-98034", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98034\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98034\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98034.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61df10c7799e27807ad5e459eec9d77cddf8bf45,86168208737bdd267d92d855d453d1d2f840df19)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[61df10c7799e27807ad5e459eec9d77cddf8bf45,ecdc5043794c9184aa8e6c814603899479c46b35)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "b5a8069835e5236824a84281592d29f859b33153"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.18.18,5.19)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T22:00:21.002794+00:00", "updated": "2026-10-01T04:15:16.824472+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}