CVE-2026-98043

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Don't infer non-NULL from a pointer with an unbounded offset

reg_not_null() decides that a register holds a non-NULL value by

looking at its type alone. For pointer types that allow arithmetic the

type only guarantees a non-NULL base, in case of an unbound offset

the runtime offset value might still add up to NULL.

Consider the followng program:

r6 = bpf_map_lookup_elem(map, &0); /* present */

if (r6 == 0) return 0;

r7 = bpf_map_lookup_elem(map, &1); /* absent, NULL at runtime */

r8 = r7;

r8 -= r6; /* pointer - pointer: unknown scalar, -r6 */

r8 <<= 1;

r8 >>= 1; /* any non-negative offset is accepted by */

/* check_reg_sane_offset_ptr() */

r6 += r8; /* verifier: map value; runtime: zero */

if (r7 != r6) return 0;

*(u8 *)(r7 + 0); /* r7 is inferred non-NULL, both are zero */

At runtime both registers are zero, the comparison is true and the

load faults with

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References