CVE-2026-53032
Description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix NULL deref in map_kptr_match_type for scalar regs
Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
before checking base_type(). A scalar register stored into a kptr
slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
NULL.
Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
access.
Summary dbcve.org
NULL pointer dereference in Linux kernel BPF subsystem's map_kptr_match_type() function. When a scalar register (which lacks BTF metadata) is stored into a kptr slot, the code calls btf_is_kernel(reg->btf) without first checking if reg->btf exists, causing a NULL dereference. The fix moves the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.
Mitigation
Apply the kernel patch that repositions the base_type() check to guard against NULL reg->btf access. Update to a kernel version containing the fix for commit ab6c637ad027.