MEDIUM

CVE-2026-53032

Linux Linux Kernel 2026-06-24 CVSS v3.1
CVSS
5.5

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL deref in map_kptr_match_type for scalar regs

Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
before checking base_type(). A scalar register stored into a kptr
slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
NULL.

Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
access.

Summary dbcve.org

NULL pointer dereference in Linux kernel BPF subsystem's map_kptr_match_type() function. When a scalar register (which lacks BTF metadata) is stored into a kptr slot, the code calls btf_is_kernel(reg->btf) without first checking if reg->btf exists, causing a NULL dereference. The fix moves the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.

Mitigation

Apply the kernel patch that repositions the base_type() check to guard against NULL reg->btf access. Update to a kernel version containing the fix for commit ab6c637ad027.

Patch Commit

Weakness (CWE)

CWE-476 NULL Pointer Dereference

EPSS Score

0.12%
Probability of exploitation in next 30 days
2.3th percentile

References

View on dbcve.org
Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.
Back to CVE