Linux Kernel 4.c bpf bpf_sk_storage.c bpf_selem_unlink_nofail null pointer dereference

Summaryinfo

A vulnerability, which was classified as critical, was found in Linux Kernel 4.c. This vulnerability affects the function bpf_selem_unlink_nofail of the file net/core/bpf_sk_storage.c of the component bpf. The manipulation results in null pointer dereference. This vulnerability is known as CVE-2026-52938. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Linux Kernel 4.c. It has been classified as critical. Affected is the function bpf_selem_unlink_nofail of the file net/core/bpf_sk_storage.c of the component bpf. The manipulation with an unknown input leads to a null pointer dereference vulnerability. CWE is classifying the issue as CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. This is going to have an impact on availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before removing the selem from the storage hlist. A concurrent RCU reader in bpf_sk_storage_clone() can observe the selem still on the list with smap already NULL, causing a NULL pointer dereference. general protection fault, probably for non-canonical address 0xdffffc000000000a: KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057] RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174 Call Trace: sk_clone+0xfed/0x1980 net/core/sock.c:2591 inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222 tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571 tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729 tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855 tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347 Add a NULL check for smap in bpf_sk_storage_clone(). bpf_sk_storage_diag_put_all() has the same issue. Add a NULL check and pass the validated smap directly to diag_get(), which is refactored to take smap as a parameter instead of reading it internally. bpf_sk_storage_diag_put() uses diag->maps[i] which is always valid under its refcount, so diag->maps[i] is passed directly to diag_get().

The advisory is shared for download at git.kernel.org. This vulnerability is traded as CVE-2026-52938 since 06/09/2026. The exploitability is told to be difficult. There are known technical details, but no exploit is available.

Applying the patch 375e4e33c18dfa05c5dfd5f3dfffeb29343dd4c7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-38708). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.c

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion