---
id: CVE-2026-53032
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix NULL deref in map_kptr_match_type for scalar regs

  Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
  kptr") refactored map_kptr_match_type() to…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf: Fix NULL deref in map_kptr_match_type for scalar regs

  Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
  kptr") refactored map_kptr_match_type() to…
severity: none
published: '2026-06-24'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53032'
references:
  - url: 'https://git.kernel.org/stable/c/0a36c1f72888bca0237295a4da19cd91821a90be'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4d0a375887ab4d49e4da1ff10f9606cab8f7c3ad'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/520454e839710c327808c2fcc98e28cee77355fc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6982653ce5f119982aa58f1af58e7bfbebf39252'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/da1d615ce49a47986a8864e2371a26e97861085c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00162
epssPercentile: 0.04642
ingestedAt: '2026-07-11T19:15:12.201Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL deref in map_kptr_match_type for scalar regs

Commit ab6c637ad027 ("bpf: Fix a bpf_kptr_xchg() issue with local
kptr") refactored map_kptr_match_type() to branch on btf_is_kernel()
before checking base_type(). A scalar register stored into a kptr
slot has no btf, so the btf_is_kernel(reg->btf) call dereferences
NULL.

Move the base_type() != PTR_TO_BTF_ID guard before any reg->btf
access.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.