CVE-2026-53032: Linux Kernel NULL Pointer Dereference in eBPF Map Handling

Technical summary

CVE-2026-53032 is a NULL pointer dereference (CWE-476) in the map_kptr_match_type() function of the Linux kernel's eBPF subsystem. The vulnerability was introduced by a refactoring in commit ab6c637ad027 that reorganized type-checking logic to branch on btf_is_kernel() before validating the base register type. When a scalar register (which has no BTF metadata) is stored into a kptr slot, the code attempts to call btf_is_kernel(reg->btf), dereferencing a NULL pointer and triggering a kernel panic. The fix involves moving the base_type() != PTR_TO_BTF_ID guard check to occur before any access to reg->btf, preventing NULL dereference on scalar registers.

Business impact

This vulnerability enables local denial of service attacks against systems running affected Linux kernels, particularly those that permit unprivileged eBPF program loading or execution. Attackers can crash the kernel without data theft or privilege escalation, disrupting service availability. Organizations running containerized workloads, Kubernetes clusters, or systems where eBPF is actively used face elevated risk. The impact is limited to availability; confidentiality and integrity are not affected.

Affected systems

The Linux kernel is affected by this vulnerability. The specific affected versions depend on when commit ab6c637ad027 was merged and the kernel version at which the fix is included. Check your kernel version against the vendor advisory to determine if you are running a vulnerable build. Systems with eBPF enabled and unprivileged user access to eBPF are at highest risk.

Exploitability

The vulnerability requires local access and the ability to execute eBPF programs, typically via unprivileged BPF syscalls. An attacker must craft a malicious eBPF program that stores a scalar register into a kptr slot to trigger the NULL dereference. Exploitation is straightforward once the precondition (local eBPF execution capability) is met, but it is not remotely exploitable. This is not currently tracked in the CISA KEV catalog, suggesting in-the-wild exploitation has not been reported at publication time.

Remediation

Update the Linux kernel to a patched version that includes the fix for map_kptr_match_type(). Verify the specific kernel version against your vendor's security advisory, as patch version numbers vary across distributions. As a temporary control, restrict eBPF program loading to trusted users and administrators by disabling unprivileged BPF via the kernel.unprivileged_bpf_disabled sysctl parameter.

Patch guidance

Consult your Linux distribution's security advisory for the specific patched kernel version (e.g., mainline kernel version post-fix, or the next stable release from your distributor). Apply updates through your standard patch management process. For distributions with long-term support kernels, backported fixes may be available in security update channels. Verify the fix is included by confirming that the base_type() check precedes btf_is_kernel() in map_kptr_match_type() within the patched kernel source.

Detection guidance

Monitor kernel logs for NULL pointer dereference errors (typically 'BUG: unable to handle page fault for address' or similar) originating from the bpf subsystem, particularly in map_kptr_match_type(). Use kernel debugging tools (kdump, kdb) to capture crash dumps for analysis. Intrusion detection systems can flag attempts to load suspicious eBPF programs, though the fix is primarily defensive. Audit which users and processes have eBPF execution privileges.

Why prioritize this

Although the CVSS score is MEDIUM (5.5), this issue is a straightforward denial-of-service vector that requires only local execution capability. Prioritize this for patching in environments where eBPF is widely used (container orchestration, serverless platforms, or security observability tools) or where unprivileged users have eBPF access. Systems with strict eBPF restrictions (unprivileged BPF disabled) face lower immediate risk but should still be patched to maintain defense-in-depth.

Risk score, explained

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H score reflects a local attack vector requiring low privileges, low complexity, no user interaction, and high availability impact. The lack of confidentiality or integrity impact limits the severity, but the ease of triggering a kernel panic justifies the MEDIUM rating. Organizations with extensive eBPF deployments should treat this as higher priority than the base score alone suggests.

Frequently asked questions