CVE-2026-98019

Overview

This CVE addresses a flaw in the Linux kernel’s BPF subsystem where nullable arguments were not properly validated, allowing a checkpoint to prune against arbitrary scalar values. The issue could lead to incorrect program behavior or denial of service in BPF programs. It was fixed by ensuring precise checks for null arguments and enforcing zero for the second parameter of bpf_get_local_storage().

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.

Impact

Confidentiality: kernel data may be exposed through incorrect checkpoint pruning. Integrity: BPF programs may behave unpredictably, leading to incorrect data handling. Availability: the flaw could cause BPF program crashes or kernel panics. Defenders: kernel maintainers and system administrators running BPF programs are impacted.

Remediation

Apply the latest kernel patch that includes the fix for CVE-2026-98019. Ensure the kernel is updated to a version where bpf_register_is_null() and bpf_get_local_storage() checks are enforced. Verify that BPF programs are compiled with the latest headers and monitor kernel logs for BPF-related errors.

Risk context

Medium severity; no EPSS data available. The vulnerability is not currently exploited in the wild, but defenders should update kernels promptly to mitigate potential misuse.

Affected products

• Linux kernel