Junglewise Threat Intelligence

CVE-2026-53032: Linux kernel NULL dereference in BPF map_kptr_match_type

CVE-2026-53032 · Severity: info · Published 2026-06-24

Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. A flaw in how the system validates certain data types can lead to a kernel crash (NULL pointer dereference). This could allow a local attacker to cause a denial-of-service condition, potentially disrupting system operations or crashing the entire server.

Technical details

A NULL pointer dereference exists in the Linux kernel BPF verifier within the 'map_kptr_match_type' function. The issue was introduced by a refactoring that called 'btf_is_kernel(reg->btf)' before verifying the register's base type. When a scalar register is stored into a kptr slot, it lacks BTF (BPF Type Format) data, causing the 'reg->btf' access to dereference a NULL pointer. An attacker with the ability to load and execute BPF programs could trigger this flaw to cause a kernel panic. The fix involves reordering the checks to ensure the 'base_type' is validated as 'PTR_TO_BTF_ID' before any BTF-related fields are accessed.

Affected products

  • Linux Linux 6.4.16 through 6.5, 6.6 through 6.6.141, 6.12.91, 6.18.33, 7.0.10

Timeline

  • 2026-04-16: disclosed: Initial fix developed by Mykyta Yatsenko
  • 2026-06-24: advisory: CVE-2026-53032 published

References