CVE-2026-98063

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98063", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:19:56.073Z", "datePublished": "2026-09-25T10:24:07.203Z", "dateUpdated": "2026-10-19T09:13:13.031Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:13:13.031Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix NULL-ptr-deref in btf_var_show()\n\nbtf_var_show() calls btf_type_id_resolve() unconditionally, which\ndereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the\nvmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is\nnot resolved during parsing. btf_modifier_show() guards this with\n'if (btf->resolved_ids)', but btf_var_show() does not.\n\nA BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux\nBTF to bpf_snprintf_btf() thus NULL-derefs:\n\nKASAN: probably user-memory-access in range [0x46638-0x4663f]\nRIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)\nCall Trace:\n <TASK>\n btf_type_show (kernel/bpf/btf.c:8259)\n btf_type_snprintf_show (kernel/bpf/btf.c:8329)\n bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)\n bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)\n __sys_bpf (kernel/bpf/syscall.c:4804)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n </TASK>\n\nResolve the var's type directly with btf_type_skip_modifiers() when\nresolved_ids is NULL, mirroring btf_modifier_show()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/btf.c"], "versions": [{"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "5756450c9a702da0efb4a993d0a6766b965736f3", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "e83fcbe3b5d4a1ffb0569bb7c280358065c6017a", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "aec0a9c1579eb9edf534960be592d09481bd7ac3", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "e472ae0d97865e2021ee668a13eab64013aebf23", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "ca086264e98108b44fdf53971033811a48defe2b", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "ea383b3ea56979ce54c8aa88e6ec67164986c401", "status": "affected", "versionType": "git"}, {"version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "lessThan": "5403a383f52fc0905703b488f7c3db4b2447dc58", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/btf.c"], "versions": [{"version": "5.10", "status": "affected"}, {"version": "0", "lessThan": "5.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5756450c9a702da0efb4a993d0a6766b965736f3"}, {"url": "https://git.kernel.org/stable/c/e83fcbe3b5d4a1ffb0569bb7c280358065c6017a"}, {"url": "https://git.kernel.org/stable/c/e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2"}, {"url": "https://git.kernel.org/stable/c/aec0a9c1579eb9edf534960be592d09481bd7ac3"}, {"url": "https://git.kernel.org/stable/c/e472ae0d97865e2021ee668a13eab64013aebf23"}, {"url": "https://git.kernel.org/stable/c/ca086264e98108b44fdf53971033811a48defe2b"}, {"url": "https://git.kernel.org/stable/c/ea383b3ea56979ce54c8aa88e6ec67164986c401"}, {"url": "https://git.kernel.org/stable/c/5403a383f52fc0905703b488f7c3db4b2447dc58"}], "title": "bpf: Fix NULL-ptr-deref in btf_var_show()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/btf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5756450c9a702da0efb4a993d0a6766b965736f3", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "e83fcbe3b5d4a1ffb0569bb7c280358065c6017a", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "aec0a9c1579eb9edf534960be592d09481bd7ac3", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "e472ae0d97865e2021ee668a13eab64013aebf23", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "ca086264e98108b44fdf53971033811a48defe2b", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "ea383b3ea56979ce54c8aa88e6ec67164986c401", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}, {"lessThan": "5403a383f52fc0905703b488f7c3db4b2447dc58", "status": "affected", "version": "c4d0bfb45068d853a478b9067a95969b1886a30f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/btf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.10"}, {"lessThan": "5.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix NULL-ptr-deref in btf_var_show()\n\nbtf_var_show() calls btf_type_id_resolve() unconditionally, which\ndereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the\nvmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is\nnot resolved during parsing. btf_modifier_show() guards this with\n'if (btf->resolved_ids)', but btf_var_show() does not.\n\nA BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux\nBTF to bpf_snprintf_btf() thus NULL-derefs:\n\nKASAN: probably user-memory-access in range [0x46638-0x4663f]\nRIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)\nCall Trace:\n <TASK>\n btf_type_show (kernel/bpf/btf.c:8259)\n btf_type_snprintf_show (kernel/bpf/btf.c:8329)\n bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)\n bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)\n __sys_bpf (kernel/bpf/syscall.c:4804)\n do_syscall_64 (arch/x86/entry/syscall_64.c:84)\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n </TASK>\n\nResolve the var's type directly with btf_type_skip_modifiers() when\nresolved_ids is NULL, mirroring btf_modifier_show()."}], "id": "CVE-2026-98063", "lastModified": "2026-10-19T10:18:00.800", "metrics": {}, "published": "2026-09-25T11:17:35.327", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5403a383f52fc0905703b488f7c3db4b2447dc58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5756450c9a702da0efb4a993d0a6766b965736f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aec0a9c1579eb9edf534960be592d09481bd7ac3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca086264e98108b44fdf53971033811a48defe2b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e0d6a06171633d3ee3f7a39b57e5c845fb2b79f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e472ae0d97865e2021ee668a13eab64013aebf23"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e83fcbe3b5d4a1ffb0569bb7c280358065c6017a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea383b3ea56979ce54c8aa88e6ec67164986c401"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Undergoing Analysis"}

{"bugzilla": {"description": "kernel: bpf: Fix NULL-ptr-deref in btf_var_show()", "id": "2541227", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541227"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Fix NULL-ptr-deref in btf_var_show()\nbtf_var_show() calls btf_type_id_resolve() unconditionally, which\ndereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the\nvmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is\nnot resolved during parsing. btf_modifier_show() guards this with\n'if (btf->resolved_ids)', but btf_var_show() does not.\nA BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux\nBTF to bpf_snprintf_btf() thus NULL-derefs:\nKASAN: probably user-memory-access in range [0x46638-0x4663f]\nRIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)\nCall Trace:\n<TASK>\nbtf_type_show (kernel/bpf/btf.c:8259)\nbtf_type_snprintf_show (kernel/bpf/btf.c:8329)\nbpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)\nbpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)\n__sys_bpf (kernel/bpf/syscall.c:4804)\ndo_syscall_64 (arch/x86/entry/syscall_64.c:84)\nentry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n</TASK>\nResolve the var's type directly with btf_type_skip_modifiers() when\nresolved_ids is NULL, mirroring btf_modifier_show().", "A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When formatting data using BPF Type Format (BTF), the kernel attempts to access type identifiers without checking if they are initialized. A local user with permissions to execute BPF programs can exploit this vulnerability to trigger a NULL pointer dereference, causing a system crash and resulting in a denial of service."], "name": "CVE-2026-98063", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98063\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98063\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98063.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4d0bfb45068d853a478b9067a95969b1886a30f,e472ae0d97865e2021ee668a13eab64013aebf23)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4d0bfb45068d853a478b9067a95969b1886a30f,ca086264e98108b44fdf53971033811a48defe2b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4d0bfb45068d853a478b9067a95969b1886a30f,ea383b3ea56979ce54c8aa88e6ec67164986c401)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c4d0bfb45068d853a478b9067a95969b1886a30f,5403a383f52fc0905703b488f7c3db4b2447dc58)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.111,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.53,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.7,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3-rc2,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T16:30:15.787363+00:00", "updated": "2026-09-30T09:30:18.357187+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}