CVE-2026-98063

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL-ptr-deref in btf_var_show()

btf_var_show() calls btf_type_id_resolve() unconditionally, which

dereferences btf->resolved_ids. That is NULL for a base BTF - e.g. the

vmlinux BTF that bpf_snprintf_btf() renders against - since base BTF is

not resolved during parsing. btf_modifier_show() guards this with

'if (btf->resolved_ids)', but btf_var_show() does not.

A BPF program that passes the type_id of a BTF_KIND_VAR from the vmlinux

BTF to bpf_snprintf_btf() thus NULL-derefs:

KASAN: probably user-memory-access in range [0x46638-0x4663f]

RIP: 0010:btf_var_show (kernel/bpf/btf.c:2929)

Call Trace:

<TASK>

btf_type_show (kernel/bpf/btf.c:8259)

btf_type_snprintf_show (kernel/bpf/btf.c:8329)

bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)

bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)

__sys_bpf (kernel/bpf/syscall.c:4804)

do_syscall_64 (arch/x86/entry/syscall_64.c:84)

entry_SYSCALL_64_after_hwframe (ar

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References