[CVE-2026-98037][MODERATE 7.0] bpf: Reject untrusted allocated-object pointers [ Upstream

[CVE-2026-98037][MODERATE 7.0] bpf: Reject untrusted allocated-object pointers [ Upstream

[AL-KERNEL]

CVE: CVE-2026-98037
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: bpf: Reject untrusted allocated-object pointers [ Upstream
Commit: 092c2874dc1b2060fa77a465a971acd4fdf87683
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=092c2874dc1b2060fa77a465a971acd4fdf87683
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98037
Analysis date: Sat, 26 Sep 2026 14:09:12 -0400
ActionableScore: 4
ActionableScore lower bound: unknown
Actionable bucket: Borderline / manual review recommended
Manual review required: YES

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98037 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98037

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE 7.0
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-98037	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-98037 CHECK WITH IMPACT FROM ORIG NN LOW	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H';*CWE-416;**CWE-476;*CWE-672;Other CVSS 'AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H';BEST CVSS score: '7';DESCR 'A BPF verifier lifetime tracking flaw can allow a PTR_UNTRUSTED pointer with MEM_ALLOC to remain classified as a live allocated object after the final RCU read side critical section ends. A refcount or graph kfunc such as `bpf_refcount_acquire()` may then accept and dereference a NULL pointer or stale object memory. The NULL case can crash the kernel and cause denial of service. The stale pointer case is a use after free candidate because the object lifetime is no longer protected, and a refcount operation on reused memory may provide a constrained memory corruption primitive with a possible path to local privilege escalation. For the CVSS the PR:L value is used because the attacker must be able to load or control a suitable BPF program, but this access may be delegated through CAP_BPF, a container, or a restricted service account without granting complete administrative control. The issue is locally reachable and is not directly triggered by network traffic. Impact is at least a local denial of service via kernel crash and in the worst case may affect confidentiality and integrity through stale memory access and refcount corruption.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Borderline / manual review recommended (with actual score 4)  SKIP CVE-2026-98037 UNKNOWN SKIP No affected files built, so skip this CVE NO  - - unknown 	MAYBE	BPF SIMPLEFIX IMPROVEONLY LINUS  KPANIC INCREASED_FROM_LOW_BASED_ON_REQUIREMANUALCHECK	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=4
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=YES
ManualReview=REQUIRED
AutoDowngradeAllowed=NO

1. ActionableScore

* Raw conservative score: 3
* Conservative score: 4
* Raw paranoid score: 4
* Paranoid score: 4
* Applied conservative FLOOR 4: 3 -> 4 because a real active-object UAF is directly implied, the stale pointer is consumed, and host-admin-equivalent privilege is not positively established.
* No FLOOR 5 was applied. Below-host-admin reachability, controlled reuse, and repeatable attacker-driven lifetime manipulation are not established.
* Final recommended bucket: **Borderline / manual review recommended**::

2. Signal breakdown

Conservative signals:

* +2 Real UAF / active lifetime violation. After RCU protection ends, the pointer can reference an object whose lifetime has ended, but the verifier still permits a kfunc to consume it.
* +1 Reliable kernel crash / strong DoS. The accepted pointer may be NULL or stale, and `bpf_refcount_acquire()` can dereference it in kernel context.
* Total: 3.
* FLOOR 4 raises the conservative result to 4.

Paranoid signals:

* +2 Real UAF / active lifetime violation.
* +1 Reliable kernel crash / strong DoS.
* +1 Weak exploitation concern. The stale operation is a refcount acquisition rather than only a passive read, so it may modify lifetime metadata in freed or reused storage. This remains constrained because reclaim and target control are not demonstrated.
* Total: 4.
* No paranoid floor or cap changes the result.

Important non-awarded signals:

* Controlled reclaim or attacker-shaped replacement contents are not demonstrated.
* Arbitrary or directed kernel write is not demonstrated.
* Strong LPE leverage is not awarded merely because a stale refcount may be modified.
* Structured stale-object leverage is not separately awarded because attacker control over replacement or reused object fields is unresolved.
* Attacker-influenced repeatable lifetime manipulation is not awarded because the supplied context does not establish control over the object free and reuse sequence.
* Concrete repeated release/refcount +1 is not awarded. No first release on the exact reference followed by a second release is visible.
* Paranoid repeated-refcount +1 is withheld for the same reason.
* Extra Availability is not awarded because it would duplicate the kernel-crash consequence.
* Confidentiality and integrity points are not awarded without disclosure, controlled replacement, or a directed corruption target.
* Remote reachability is not established.
* No race penalty is applied because the supplied evidence does not establish a narrow or unreliable timing window.
* The BPF privileged-control-plane exception was checked. It does not erase the UAF, but privilege uncertainty and absent reclaim evidence prevent FLOOR 5.

3. Reachability analysis

The attacker must load or control a BPF program capable of obtaining the relevant local kptr, ending the applicable RCU read-side critical section, and invoking a refcount or graph kfunc afterward.

Modern deployments commonly restrict BPF loading through `CAP_BPF`, related capabilities, or broader administrative policy, and may disable unprivileged BPF through `unprivileged_bpf_disabled`. The supplied evidence does not establish whether the complete load and execution path requires host-admin-equivalent privilege or can be delegated below host administration. Therefore, `HostAdminRequired=UNKNOWN`.

No evidence establishes that all required BPF operations are available through attacker-created user or network namespaces. Therefore, `NamespaceScopedPrivilege=UNKNOWN`. No local-unprivileged bonus or privilege penalty is applied.

No network attachment is inherently required by the shown verifier defect, and packet traffic does not directly trigger it. No special hardware is required. The verifier-accepted sequence appears program-controlled, but the timing and controllability of actual object destruction and reuse remain unresolved.

4. Primitive and severity interpretation

The exact primitive is acceptance of a `PTR_UNTRUSTED | MEM_ALLOC` pointer as a live allocated object after its RCU lifetime protection has ended. A kfunc can consequently dereference NULL or use stale post-lifetime object storage.

This is an active structured-object lifetime violation, not fixed stale storage and not merely a cleanup or destructor dereference. In the `bpf_refcount_acquire()` path, the stale operation can attempt a write-like refcount update. That is meaningful Class B evidence, but it does not establish controlled reclaim, refcount takeover, arbitrary write, callback control, disclosure, or privilege escalation.

There is no concrete repeated-release pattern in the supplied patch. The earlier loss of lifetime protection is established, but a visible first release of the exact reference followed by a second release is not. Therefore, the dedicated repeated-release signal and FLOOR 5 condition do not apply.

The demonstrated consequence is kernel NULL or stale-memory dereference with potential crash. A constrained refcount mutation in reused storage is technically plausible, but useful target selection and exploitation are unresolved.

`ImportantCandidate=YES` because an active stale pointer can reach a lifetime-mutating kfunc, so Important-versus-Moderate leverage requires manual examination. `AutoDowngradeAllowed=NO` because automatically treating the issue as ordinary crash-only behavior could discard unresolved post-lifetime refcount corruption. The available evidence is nevertheless insufficient for Class A or an Important-grade numeric score.

5. One-sentence report phrase

A BPF verifier lifetime flaw permits an untrusted allocated-object pointer to reach refcount or graph kfuncs after RCU protection ends, causing a NULL dereference or a Class B stale-object refcount mutation that requires manual exploitation review.

6. Manual review recommendation

MANUAL CHECK REQUIRED

The patch directly establishes a real active-object UAF candidate and permits a refcount operation through stale storage, but the available context does not resolve reclaim control, affected object types, privilege boundaries, or practical privilege-escalation leverage.

7. Call-site confidence

Call-site confidence: medium

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: bpf: Reject untrusted allocated-object pointers [ Upstream
Commit: 092c2874dc1b2060fa77a465a971acd4fdf87683
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=092c2874dc1b2060fa77a465a971acd4fdf87683

Changed files:
  include/linux/bpf_verifier.h

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=092c2874dc1b2060fa77a465a971acd4fdf87683

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-98037 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-98037

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 7

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: unknown
  Paranoid ActionableScore: 4

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).