NetSight
IP …
medium5.5

CVE-2026-53032

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL deref in map_kptr_match_type for scalar regs Commit ab6c637ad027 ("bpf: Fix a…

Impact

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL deref in map_kptr_match_type for scalar regs Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL. Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 6.4.16 before 6.5
from 6.5.3 before 6.6.141
from 6.7 before 6.12.91
from 6.13 before 6.18.33
from 6.19 before 7.0.10

Weakness classification

CWE-476

References