CVE-2026-53032
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel, a vulnerability in the BPF subsystem causes a NULL pointer dereference in map_kptr_match_type() when a scalar register is stored into a kptr slot. The code accesses reg->btf without first checking if the register has a BTF type, leading to a crash.
Risk Assessment
A local attacker could trigger a kernel panic (denial of service) or potentially escalate privileges if the NULL dereference leads to uncontrolled behavior.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit ab6c637ad027 with additional guard). Monitor your distribution for a security patch.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL deref in map_kptr_match_type for scalar regs Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL. Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.