CVE-2026-98019

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-09-25 11:17:30.363000

Last modified

2026-10-21 13:21:19.180000

View original CVE JSON

{
  "id": "CVE-2026-98019",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-09-25T11:17:30.363",
  "lastModified": "2026-10-21T13:21:19.180",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: mark a NULL call argument precise\n\ncheck_func_arg() allows bpf_register_is_null() for nullable arguments\nw/o marking the underlying scalar register precise. Hence a checkpoint\ncreated on such a path would prune against arbitrary scalar value.\n\ncheck_helper_call() enforces second parameter of the\nbpf_get_local_storage() to be zero, w/o marking the underlying scalar\nregister precise. Hence a checkpoint created on such a path would\nprune against arbitrary scalar value.\n\nGrouping these two into one patch, as they share the same fixes tag."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "kernel/bpf/verifier.c",
            "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
              "lessThan": "febbb66e682d8328f7c5bcbdd5e4291abab2e858",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
              "lessThan": "627089c278df58749f25686c6a3caf7e181b5951",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
              "lessThan": "b1fe6379e401b8ce0f561cb4d84af2b70b4343c3",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
              "lessThan": "69a9ad004ccf5d45e534c7d503f47f643abe64b7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
              "lessThan": "1a3a10b030c96ea88868ccc060a16827c01eaa5a",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "kernel/bpf/verifier.c",
            "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "5.3",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "5.3",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.160",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.114",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.57",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.7",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/627089c278df58749f25686c6a3caf7e181b5951",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/69a9ad004ccf5d45e534c7d503f47f643abe64b7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1fe6379e401b8ce0f561cb4d84af2b70b4343c3",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/febbb66e682d8328f7c5bcbdd5e4291abab2e858",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}