---
id: CVE-2026-98134
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: check_cond_jmp_op(): properly infer if register is null

  Nicholas Carlini reported a bug when verifier can incorrectly infer
  that a pointer is non-null
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: check_cond_jmp_op(): properly infer if register is null

  Nicholas Carlini reported a bug when verifier can incorrectly infer
  that a pointer is non-null. The bug oc…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 6.2, < 7.2.7'
  - linux_kernel = 7.3
patched:
  - linux_kernel 7.2.7
published: '2026-09-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:18:11.633'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98134'
references:
  - url: 'https://git.kernel.org/stable/c/9bf96b4347f541604b3caadeabda0773d9ceaf2a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b55c9f019e169ed0d01394f96e172286a8b21b99'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d3ef6c097ba078e1f8c7239d76a0ce8b61e75095'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98134.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98134'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541352'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98134'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98134'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98134.mbox
  - url: 'https://git.kernel.org/stable/c/d51cd486930f5bcfd4b55d55ab8e47b03f93d2ed'
  - url: 'https://git.kernel.org/stable/c/dfd8f8adda565e08c370c45cf9d6b2511ba9b5c6'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00155
epssPercentile: 0.04561
ingestedAt: '2026-09-25T11:06:38.812Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: check_cond_jmp_op(): properly infer if register is null

Nicholas Carlini reported a bug when verifier can incorrectly infer
that a pointer is non-null. The bug occurs when two pointers are
compared and one of them has a type w/o PTR_MAYBE_NULL flag,
but which allows a value to be NULL at runtime.
Here is an example:

  // `a` is PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED
  // `a` is 0 at runtime.
  // `b` is PTR_TO_MAP_VALUE | PTR_MAYBE_NULL
  void *a = bpf_rdonly_cast(0, 0);
  int  *b = bpf_map_lookup_elem(...);

  if (a == b)
    *b = 42;  // verifier does not catch null pointer dereference

This happens because of a special case in check_cond_jmp_op(),
which attempts to strip PTR_MAYBE_NULL flags from pointer types,
when processing comparisons like `rA == rB`, if either rA or rB can't
be null.

The non-null property is derived based on the absence of
PTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient
for types like PTR_TO_MEM, as in the example.

This patch replaces type_may_be_null() call with reg_not_null(),
which contains an allowlist of types for which absence of
PTR_MAYBE_NULL actually means that the value can't be NULL at runtime.

At the moment, the list in the reg_not_null() omits two types for
which PTR_MAYBE_NULL is applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF.
In order to remain backward compatible, and assuming that only
comparison between pointers of the same type makes sense,
this commit extends reg_not_null(). W/o such an extension e.g.
verifier_jeq_infer_not_null/null_ptr_to_map_value fails.

reg_not_null() can be extended further, but I deem that out of scope
for the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID
checks in the check_cond_jmp_op() can be removed with migration to
reg_not_null(), but that is a behavioural change, as the special case
would start matching for PTR_TO_BTF_ID that is also is_trusted_reg().
I omit the behavioural change from this commit.

## Affected

- `linux_kernel >= 6.2, < 7.2.7`
- `linux_kernel = 7.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.2.7`

## Vendor advisories

- **Red Hat VEX** · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-17 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98134.json)