CVE-2026-98043bpf: Don't infer non-NULL from a pointer with an unbounded offset
- —Not scoredno CVSS score yet
- 0.20%Exploitation in 30 daysEPSS · top 90% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset reg_not_null() decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL base, in case of an unbound offset the runtime offset value might still add up to NULL. Consider the followng program: r6 = bpf_map_lookup_elem(map, &0); /* present */ if (r6 == 0) return 0; r7 = bpf_map_lookup_elem(map, &1); /* absent, NULL at runtime */ r8 = r7; r8 -= r6; /* pointer - pointer: unknown scalar, -r6 */ r8 <<= 1; r8 >>= 1; /* any non-negative offset is accepted by */ /* check_reg_sane_offset_ptr() */ r6 += r8; /* verifier: map value; runtime: zero */ if (r7 != r6) return 0; *(u8 *)(r7 + 0); /* r7 is inferred non-NULL, both are zero */ At runtime both registers are zero, the comparison is true and the load faults with NULL pointer dereference. Require the offset to be within +-BPF_MAX_VAR_OFF in reg_not_null().
Timeline
ID reserved
By Linux
Published
- 26 days later
· 26 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.20% · top 90% of all CVEs (13 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 – < 8b414dbe97fcefd116e5a620c3bd9993014aa4ce
- affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 – < 019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae
- affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 – < 65bea674f43c09c0eda033a140dfac6a2842a19f
- affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 – < cb6642048739bf4ee5aa09fe465511f1e87caa63
- affected cac616db39c207dc63465a4e05c6ce0e60b2cce4 – < 67b529f521a6676cdfc78b91b0217d7eaa84216b
- affected 5.8
- unaffected < 5.8
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.7 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/8b414dbe97fcefd116e5a620c3bd9993014aa4ce (opens in a new tab)
- https://git.kernel.org/stable/c/019d845a08b8ccfe8eefaaf4bca6870f2b8c58ae (opens in a new tab)
- https://git.kernel.org/stable/c/65bea674f43c09c0eda033a140dfac6a2842a19f (opens in a new tab)
- https://git.kernel.org/stable/c/cb6642048739bf4ee5aa09fe465511f1e87caa63 (opens in a new tab)
- https://git.kernel.org/stable/c/67b529f521a6676cdfc78b91b0217d7eaa84216b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-86696 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-98043)Record last updated .