CVE-2026-98064

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL-ptr-deref when showing a void BTF type

btf_modifier_show() resolves the modifier and then calls

btf_type_ops(t)->show() unconditionally. For the void type (type_id 0,

BTF_KIND_UNKN) kind_ops[] has no entry, so ->show is NULL.

A "const void" (a modifier resolving to void) cannot be a map key or

value - map_check_btf() rejects it because void has no size - so the map

dump path does not reach it. But bpf_snprintf_btf() takes a type_id

straight from the BPF program, and passing such a "const void" from the

vmlinux BTF NULL-derefs:

KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f]

RIP: 0010:btf_modifier_show (kernel/bpf/btf.c:2914)

Call Trace:

<TASK>

btf_type_show (kernel/bpf/btf.c:8251)

btf_type_snprintf_show (kernel/bpf/btf.c:8321)

bpf_snprintf_btf (kernel/trace/bpf_trace.c:1047)

bpf_prog_test_run_raw_tp (net/bpf/test_run.c:829)

__sys_bpf (kernel/bpf/syscall.c:4804)

do_syscall

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References