SB20260928161 - NULL pointer dereference in Linux kernel bpf

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-98038)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to trigger a null pointer dereference.

The vulnerability exists due to improper reference ownership tracking in the BPF verifier when verifying BPF programs that acquire references from borrowed RCU kptrs. A local user can load a crafted BPF program that uses a borrowed RCU kptr without a required NULL check to trigger a null pointer dereference.

The issue occurs when the refcounted object does not contain a graph node and its last real reference is dropped during an RCU critical section.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/85074498228a2500ea8b8039c49cc1ab8ad5328f
• https://git.kernel.org/stable/c/dc36739e5cc9f60485418a910b42bc95339218d2