CVE-2026-98037

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98037", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.071Z", "datePublished": "2026-09-25T10:23:51.126Z", "dateUpdated": "2026-10-19T09:12:42.963Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:42.963Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject untrusted allocated-object pointers\n\nWhen the final RCU read-side critical section ends, a local kptr is demoted\nto PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer\nto an object whose lifetime is no longer protected.\n\ntype_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with\nMEM_ALLOC as a live allocated object. In particular, a refcount-only local\nkptr never carries NON_OWN_REF, so it still passes the\nbpf_refcount_acquire() argument check after RCU protection ends. The kfunc\ncan then dereference NULL or stale memory.\n\nMake type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since\ntype_is_non_owning_ref() is based on the same predicate, graph kfunc\narguments obey the same live-object requirement. Fault-protected reads of\nthe demoted pointer remain valid: writes are already rejected, and read\nfixups use bpf_may_fault_on_deref() rather than this predicate.\n\n[ kkd: Rewrote commit log ]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf_verifier.h"], "versions": [{"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "lessThan": "092c2874dc1b2060fa77a465a971acd4fdf87683", "status": "affected", "versionType": "git"}, {"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "lessThan": "135d542b97fa93e32c457d49d6e7b33ca7d05bae", "status": "affected", "versionType": "git"}, {"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "lessThan": "6b1f786ad85a0b63393b76f5e634deab1a73198c", "status": "affected", "versionType": "git"}, {"version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "lessThan": "7441ee8276641bddaf1cba7bb75ef9c1458ceb3b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf_verifier.h"], "versions": [{"version": "6.8", "status": "affected"}, {"version": "0", "lessThan": "6.8", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/092c2874dc1b2060fa77a465a971acd4fdf87683"}, {"url": "https://git.kernel.org/stable/c/135d542b97fa93e32c457d49d6e7b33ca7d05bae"}, {"url": "https://git.kernel.org/stable/c/6b1f786ad85a0b63393b76f5e634deab1a73198c"}, {"url": "https://git.kernel.org/stable/c/7441ee8276641bddaf1cba7bb75ef9c1458ceb3b"}], "title": "bpf: Reject untrusted allocated-object pointers", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/bpf_verifier.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "092c2874dc1b2060fa77a465a971acd4fdf87683", "status": "affected", "version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "versionType": "git"}, {"lessThan": "135d542b97fa93e32c457d49d6e7b33ca7d05bae", "status": "affected", "version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "versionType": "git"}, {"lessThan": "6b1f786ad85a0b63393b76f5e634deab1a73198c", "status": "affected", "version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "versionType": "git"}, {"lessThan": "7441ee8276641bddaf1cba7bb75ef9c1458ceb3b", "status": "affected", "version": "1b12171533a9bb23cf6fba7262b479028b65e1e8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/bpf_verifier.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"lessThan": "6.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject untrusted allocated-object pointers\n\nWhen the final RCU read-side critical section ends, a local kptr is demoted\nto PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer\nto an object whose lifetime is no longer protected.\n\ntype_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with\nMEM_ALLOC as a live allocated object. In particular, a refcount-only local\nkptr never carries NON_OWN_REF, so it still passes the\nbpf_refcount_acquire() argument check after RCU protection ends. The kfunc\ncan then dereference NULL or stale memory.\n\nMake type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since\ntype_is_non_owning_ref() is based on the same predicate, graph kfunc\narguments obey the same live-object requirement. Fault-protected reads of\nthe demoted pointer remain valid: writes are already rejected, and read\nfixups use bpf_may_fault_on_deref() rather than this predicate.\n\n[ kkd: Rewrote commit log ]"}], "id": "CVE-2026-98037", "lastModified": "2026-10-19T10:17:57.647", "metrics": {}, "published": "2026-09-25T11:17:32.443", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/092c2874dc1b2060fa77a465a971acd4fdf87683"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/135d542b97fa93e32c457d49d6e7b33ca7d05bae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6b1f786ad85a0b63393b76f5e634deab1a73198c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7441ee8276641bddaf1cba7bb75ef9c1458ceb3b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Reject untrusted allocated-object pointers", "id": "2541230", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541230"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Reject untrusted allocated-object pointers\nWhen the final RCU read-side critical section ends, a local kptr is demoted\nto PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer\nto an object whose lifetime is no longer protected.\ntype_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with\nMEM_ALLOC as a live allocated object. In particular, a refcount-only local\nkptr never carries NON_OWN_REF, so it still passes the\nbpf_refcount_acquire() argument check after RCU protection ends. The kfunc\ncan then dereference NULL or stale memory.\nMake type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since\ntype_is_non_owning_ref() is based on the same predicate, graph kfunc\narguments obey the same live-object requirement. Fault-protected reads of\nthe demoted pointer remain valid: writes are already rejected, and read\nfixups use bpf_may_fault_on_deref() rather than this predicate.\n[ kkd: Rewrote commit log ]", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. An improper validation check fails to reject untrusted allocated-object pointers after their protection scope expires, incorrectly recognizing them as valid live objects. A local user with permissions to load BPF programs can exploit this issue to pass invalid pointers to kernel functions, causing the kernel to dereference freed or null memory. This can lead to a Denial of Service (DoS) via a system crash or potential memory corruption."], "name": "CVE-2026-98037", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98037\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98037\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98037.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b12171533a9bb23cf6fba7262b479028b65e1e8,092c2874dc1b2060fa77a465a971acd4fdf87683)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b12171533a9bb23cf6fba7262b479028b65e1e8,135d542b97fa93e32c457d49d6e7b33ca7d05bae)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b12171533a9bb23cf6fba7262b479028b65e1e8,6b1f786ad85a0b63393b76f5e634deab1a73198c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1b12171533a9bb23cf6fba7262b479028b65e1e8,7441ee8276641bddaf1cba7bb75ef9c1458ceb3b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T15:15:14.509897+00:00", "updated": "2026-09-30T14:15:16.117476+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}