CVE-2026-52938

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the BPF (Berkeley Packet Filter) subsystem. The function bpf selem unlink nofail() sets the smap variable to NULL before removing the element from the storage hlist. A concurrent RCU (Read-Copy-Update) reader in the bpf sk storage clone() function can observe the element while it is still on the list but with smap already set to NULL, leading to a system crash. A similar issue occurs in the bpf sk storage diag put all() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.