{"id":"CVE-2026-98037","revision":"dce24aa8184a4b6cb59c3127837cf81e","records":[{"revision":"dce24aa8184a4b6cb59c3127837cf81e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98037","aliases":[],"title":"bpf: Reject untrusted allocated-object pointers","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject untrusted allocated-object pointers\n\nWhen the final RCU read-side critical section ends, a local kptr is demoted\nto PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer\nto an object whose lifetime is no longer protected.\n\ntype_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with\nMEM_ALLOC as a live allocated object. In particular, a refcount-only local\nkptr never carries NON_OWN_REF, so it still passes the\nbpf_refcount_acquire() argument check after RCU protection ends. The kfunc\ncan then dereference NULL or stale memory.\n\nMake type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since\ntype_is_non_owning_ref() is based on the same predicate, graph kfunc\narguments obey the same live-object requirement. Fault-protected reads of\nthe demoted pointer remain valid: writes are already rejected, and read\nfixups use bpf_may_fault_on_deref() rather than this predicate.\n\n[ kkd: Rewrote commit log ]","state":0,"publishedAt":"2026-09-25T10:23:51.126+00:00","modifiedAt":"2026-10-19T09:12:42.963+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/bpf_verifier.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"1b12171533a9bb23cf6fba7262b479028b65e1e8\",\n                            \"lessThan\": \"092c2874dc1b2060fa77a465a971acd4fdf87683\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1b12171533a9bb23cf6fba7262b479028b65e1e8\",\n                            \"lessThan\": \"135d542b97fa93e32c457d49d6e7b33ca7d05bae\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1b12171533a9bb23cf6fba7262b479028b65e1e8\",\n                            \"lessThan\": \"6b1f786ad85a0b63393b76f5e634deab1a73198c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1b12171533a9bb23cf6fba7262b479028b65e1e8\",\n                            \"lessThan\": \"7441ee8276641bddaf1cba7bb75ef9c1458ceb3b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/bpf_verifier.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.111\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/092c2874dc1b2060fa77a465a971acd4fdf87683","https://git.kernel.org/stable/c/135d542b97fa93e32c457d49d6e7b33ca7d05bae","https://git.kernel.org/stable/c/6b1f786ad85a0b63393b76f5e634deab1a73198c","https://git.kernel.org/stable/c/7441ee8276641bddaf1cba7bb75ef9c1458ceb3b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98037","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98037","identifiers":["CVE-2026-98037"]},"retained":false,"historicalAffected":[]}],"coverage":[]}