Linux Kernel up to 7.2.6/7.3-rc1 BPF Verifier check_func_arg privileges management

Summaryinfo

A vulnerability marked as very critical has been reported in Linux Kernel up to 7.2.6/7.3-rc1. The affected element is the function check_func_arg of the component BPF Verifier. Performing a manipulation results in privileges management. This vulnerability is known as CVE-2026-98019. Attacking locally is a requirement. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.2.6/7.3-rc1. This affects the function check_func_arg of the component BPF Verifier. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: bpf: mark a NULL call argument precise check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. check_helper_call() enforces second parameter of the bpf_get_local_storage() to be zero, w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value. Grouping these two into one patch, as they share the same fixes tag.

It is possible to read the advisory at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-98019 since 09/25/2026. The exploitability is told to be easy. Attacking locally is a requirement. The exploitation requires an enhanced level of successful authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/25/2026). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 7.2.7 or 7.3-rc2 eliminates this vulnerability. Applying the patch 69a9ad004ccf5d45e534c7d503f47f643abe64b7/1a3a10b030c96ea88868ccc060a16827c01eaa5a is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.3-rc1

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion