CVE-2026-98037

In the Linux kernel’s BPF subsystem, a flaw in the handling of allocated‑object pointers after an RCU read‑side critical section ends allows a kernel pointer that should be treated as untrusted to be considered a live allocated object. Consequently, the function type_is_ptr_alloc_obj() permits the dereference of NULL or stale memory when validated by bpf_refcount_acquire(), leading to kernel memory corruption. An attacker capable of loading a malicious BPF program could exploit this to gain elevated privileges or crash the system. The weakness reflects improper trust of allocated pointers (CWE‑825).

All Linux kernel releases that contain the unpatched logic are affected, including mainstream distributions that have not yet incorporated the upstream patch. The remedy was introduced by commit 092c2874dc1b2060fa77a465a971acd4fdf87683 and later merged into kernel commits 6b1f786ad85a0b63393b76f5e634deab1a73198c and 7441ee8276641bddaf1cba7bb75ef9c1458ceb3b. Because the advisory does not list specific distribution versions, administrators should verify that their kernel includes the change that rejects untrusted allocated‑object pointers or consult their vendor for a patched release.

The CVSS score of 7.0 indicates high severity, and the EPSS score of less than 1% suggests a low but nonzero likelihood of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, and no publicly available exploits have been reported. Based on the description, the attack vector is inferred to be local and requires the ability to load a malicious BPF program, which is typically restricted to privileged users. If successfully abused, the flaw could lead to privilege escalation, confidentiality breach, or denial of service.