CVE-2026-98037

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject untrusted allocated-object pointers

When the final RCU read-side critical section ends, a local kptr is demoted

to PTR_UNTRUSTED but retains MEM_ALLOC. The pointer may be NULL or may refer

to an object whose lifetime is no longer protected.

type_is_ptr_alloc_obj() nevertheless recognizes any PTR_TO_BTF_ID with

MEM_ALLOC as a live allocated object. In particular, a refcount-only local

kptr never carries NON_OWN_REF, so it still passes the

bpf_refcount_acquire() argument check after RCU protection ends. The kfunc

can then dereference NULL or stale memory.

Make type_is_ptr_alloc_obj() reject PTR_UNTRUSTED pointers. Since

type_is_non_owning_ref() is based on the same predicate, graph kfunc

arguments obey the same live-object requirement. Fault-protected reads of

the demoted pointer remain valid: writes are already rejected, and read

fixups use bpf_may_fault_on_deref() rather than this predicate.

[ kkd: Rew

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References