In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 5
- StatusReceived → PublishedNVD modified 2026-10-21 12:54
- References+2 references (now 5)NVD modified 2026-10-21 13:21
- StatusPublished → ReceivedNVD modified 2026-10-21 13:21
- StatusReceived → PublishedNVD modified 2026-10-19 09:12
- First seenunscoredNVD modified 2026-10-15 11:18
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://git.kernel.org/stable/c/1a3a10b030c96ea88868ccc060a16827c01eaa5a
- https://git.kernel.org/stable/c/627089c278df58749f25686c6a3caf7e181b5951
- https://git.kernel.org/stable/c/69a9ad004ccf5d45e534c7d503f47f643abe64b7
- https://git.kernel.org/stable/c/b1fe6379e401b8ce0f561cb4d84af2b70b4343c3
- https://git.kernel.org/stable/c/febbb66e682d8328f7c5bcbdd5e4291abab2e858