CVE-2026-98034

In the Linux kernel, the following vulnerability has been resolved:

bpf: Mark NULL kptr stores precise

check_map_kptr_access() permits a scalar store into an untrusted kptr

field only when the register is known to contain zero. Unlike other

verifier checks whose outcome depends on a scalar value, it does not mark

that register precise.

A state checkpoint reached with an imprecise zero can therefore prune a

second path that reaches the store with an arbitrary nonzero scalar. The

program can write attacker-controlled bits into the kptr field and load

them back as a PTR_TO_BTF_ID.

Call mark_chain_precision() before accepting a known-zero register. This

forces state equivalence to compare its scalar range and makes the verifier

visit and reject a path carrying a nonzero value.