Skip to main content

Linux Kernel CVE-2026-53032

| EUVDEUVD-2026-38900 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-vwfw-86r9-43wp
Null Pointer Dereference Linux Denial Of Service Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local BPF syscall access required (AV:L); low privilege sufficient on permissive configs (PR:L); kernel panic is the sole impact with no confidentiality or integrity effect (C:N/I:N/A:H).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 22, 2026 - 20:49 vuln.today
CVSS changed
Jul 14, 2026 - 19:52 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL deref in map_kptr_match_type for scalar regs

Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local kptr") refactored map_kptr_match_type() to branch on btf_is_kernel() before checking base_type(). A scalar register stored into a kptr slot has no btf, so the btf_is_kernel(reg->btf) call dereferences NULL.

Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf access.

AnalysisAI

NULL pointer dereference in the Linux kernel's BPF verifier crashes the kernel when a scalar register is stored into a kptr map slot during BPF program loading. Introduced by commit ab6c637ad027, which refactored map_kptr_match_type() to call btf_is_kernel(reg->btf) before the guard that excludes non-BTF register types - exposing scalar registers (reg->btf == NULL) to an immediate NULL dereference. A local user with BPF syscall access can trigger a kernel panic, producing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS is low at 0.17% (6th percentile), consistent with the local-only, DoS-limited impact.

Technical ContextAI

The vulnerability is in the BPF verifier's map_kptr_match_type() function within the Linux kernel's eBPF subsystem (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*). Kernel pointers (kptrs) allow BPF maps to store references to kernel objects tracked by the Binary Type Format (BTF) system. Commit ab6c637ad027 ('bpf: Fix a bpf_kptr_xchg() issue with local kptr') reordered checks inside map_kptr_match_type(): the new flow calls btf_is_kernel(reg->btf) - which dereferences reg->btf - before the base_type() != PTR_TO_BTF_ID check that would have short-circuited execution for scalar registers. Scalar registers carry no BTF pointer, so reg->btf is NULL, producing a CWE-476 NULL pointer dereference when the verifier processes a BPF program that writes a scalar into a kptr slot. The fix is surgical: move the base_type guard ahead of any reg->btf access.

RemediationAI

Update to a patched Linux kernel stable release: 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1, as appropriate for the installed branch. Upstream fix commits are available at https://git.kernel.org/stable/c/520454e839710c327808c2fcc98e28cee77355fc, https://git.kernel.org/stable/c/0a36c1f72888bca0237295a4da19cd91821a90be, https://git.kernel.org/stable/c/6982653ce5f119982aa58f1af58e7bfbebf39252, https://git.kernel.org/stable/c/da1d615ce49a47986a8864e2371a26e97861085c, and https://git.kernel.org/stable/c/4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad. Ubuntu users should apply updates per USN-8566-1, USN-8567-1, and USN-8568-1 at https://ubuntu.com/security/notices/. Where patching is not immediately feasible, set kernel.unprivileged_bpf_disabled=1 (sysctl) to block unprivileged BPF syscall access - this eliminates the attack surface for non-root users but will break eBPF-based tools operating without elevated privileges, including some network observability agents (bpftrace, Cilium in certain modes) and container networking stacks that rely on unprivileged BPF.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Null Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53032 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy