CVE-2026-98040

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98040", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.071Z", "datePublished": "2026-09-25T10:23:53.001Z", "dateUpdated": "2026-10-19T09:12:46.084Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:12:46.084Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark the zero register precise for a register-form NULL check\n\ncheck_cond_jmp_op() accepts \"if rA <op> rB\" as a NULL check for a\nnullable pointer rA when rB is a scalar known to be zero,\nlifts PTR_MAYBE_NULL from rA in the corresponding branch and does not\nmark rB precise. Consider the following program:\n\n r0 = bpf_get_prandom_u32();\n r6 = 1; /* the r6 == 0 path is explored first */\n if (r0 == 0) goto 1f;\n r6 = 0;\n1:\n r0 = bpf_map_lookup_elem(map, &0); /* absent, NULL at runtime */\n if (r0 == r6) goto 2f; /* taken as a NULL check for r0 */\n *(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */\n2:\n return 0;\n\nThe r6 == 0 path is explored first and the dereference is accepted.\nThe r6 == 1 path is pruned at the checkpoint recorded for (1),\nso the comparison is never verified with a non-zero r6. At runtime a\nfailed lookup returns NULL, NULL != 1 takes the non-NULL edge and the\nprogram dereferences a pointer that is zero."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "2f4cb53eed448c1aeb6f4b40cf9c810716d8218c", "lessThan": "ddca9a3b8833168dda3e62676648a636fb3f221c", "status": "affected", "versionType": "git"}, {"version": "2f4cb53eed448c1aeb6f4b40cf9c810716d8218c", "lessThan": "6aed0134d3cda6382385a734ae0158eb7df6b142", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ddca9a3b8833168dda3e62676648a636fb3f221c"}, {"url": "https://git.kernel.org/stable/c/6aed0134d3cda6382385a734ae0158eb7df6b142"}], "title": "bpf: Mark the zero register precise for a register-form NULL check", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ddca9a3b8833168dda3e62676648a636fb3f221c", "status": "affected", "version": "2f4cb53eed448c1aeb6f4b40cf9c810716d8218c", "versionType": "git"}, {"lessThan": "6aed0134d3cda6382385a734ae0158eb7df6b142", "status": "affected", "version": "2f4cb53eed448c1aeb6f4b40cf9c810716d8218c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Mark the zero register precise for a register-form NULL check\n\ncheck_cond_jmp_op() accepts \"if rA <op> rB\" as a NULL check for a\nnullable pointer rA when rB is a scalar known to be zero,\nlifts PTR_MAYBE_NULL from rA in the corresponding branch and does not\nmark rB precise. Consider the following program:\n\n r0 = bpf_get_prandom_u32();\n r6 = 1; /* the r6 == 0 path is explored first */\n if (r0 == 0) goto 1f;\n r6 = 0;\n1:\n r0 = bpf_map_lookup_elem(map, &0); /* absent, NULL at runtime */\n if (r0 == r6) goto 2f; /* taken as a NULL check for r0 */\n *(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */\n2:\n return 0;\n\nThe r6 == 0 path is explored first and the dereference is accepted.\nThe r6 == 1 path is pruned at the checkpoint recorded for (1),\nso the comparison is never verified with a non-zero r6. At runtime a\nfailed lookup returns NULL, NULL != 1 takes the non-NULL edge and the\nprogram dereferences a pointer that is zero."}], "id": "CVE-2026-98040", "lastModified": "2026-10-19T10:17:57.910", "metrics": {}, "published": "2026-09-25T11:17:32.773", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6aed0134d3cda6382385a734ae0158eb7df6b142"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddca9a3b8833168dda3e62676648a636fb3f221c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: Mark the zero register precise for a register-form NULL check", "id": "2541197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541197"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Mark the zero register precise for a register-form NULL check\ncheck_cond_jmp_op() accepts \"if rA <op> rB\" as a NULL check for a\nnullable pointer rA when rB is a scalar known to be zero,\nlifts PTR_MAYBE_NULL from rA in the corresponding branch and does not\nmark rB precise. Consider the following program:\nr0 = bpf_get_prandom_u32();\nr6 = 1; /* the r6 == 0 path is explored first */\nif (r0 == 0) goto 1f;\nr6 = 0;\n1:\nr0 = bpf_map_lookup_elem(map, &0); /* absent, NULL at runtime */\nif (r0 == r6) goto 2f; /* taken as a NULL check for r0 */\n*(u8 *)(r0 + 0); /* verifier: map value; runtime: zero */\n2:\nreturn 0;\nThe r6 == 0 path is explored first and the dereference is accepted.\nThe r6 == 1 path is pruned at the checkpoint recorded for (1),\nso the comparison is never verified with a non-zero r6. At runtime a\nfailed lookup returns NULL, NULL != 1 takes the non-NULL edge and the\nprogram dereferences a pointer that is zero.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. When validating conditional jump operations using register comparisons against null values, the verifier fails to properly track register precision across different execution paths. A local user capable of loading BPF programs can exploit this flaw to bypass safety checks and trigger a null pointer dereference, leading to a system crash and Denial of Service (DoS)."], "name": "CVE-2026-98040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98040\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98040\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98040.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f4cb53eed448c1aeb6f4b40cf9c810716d8218c,ddca9a3b8833168dda3e62676648a636fb3f221c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[2f4cb53eed448c1aeb6f4b40cf9c810716d8218c,6aed0134d3cda6382385a734ae0158eb7df6b142)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "7.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,7.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:00:18.017528+00:00", "updated": "2026-09-30T14:15:16.115638+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}