# CVE-2026-98065: linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Reject key-less BTF for hash maps  map_chec...

CVE-2026-98065 is fixed in linux on 1 platform by DEBIAN-CVE-2026-98065 (version 7.2.7-1), released October 2, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-98065
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0017
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 25, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  bpf: Reject key-less BTF for hash maps  map_check_btf() allows a key-less BTF (btf_key_type_id == 0) only for maps that have a ->map_check_btf callback, and leaves the actual decision to that callback. Hash maps used to have no ->map_check_btf, so a key-less BTF was rejected outright.  That changed when htab and rhtab gained a ->map_check_btf to register a dtor - htab in commit 1df97a7453ee ("bpf: Register dtor for freeing special fields") and rhtab in commit 6905f8601298 ("bpf: Allow special fields in resizable hashtab"). Neither looks at the key, so a key-less hash map now passes map_check_btf() and gets created. Reading it back through bpffs feeds the key type_id 0 into btf_type_seq_show(); btf_type_by_id() returns the void type, kind_ops[BTF_KIND_UNKN] is NULL, and btf_type_show() dereferences it:  RIP: 0010:btf_type_show+0x223/0x2e0 kernel/bpf/btf.c:8232 RSP: 0018:ffffc9000399f868 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000028 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: ffffc9000399f970 R11: 0000000000000001 R12: ffffffff9b96b140 R13: ffffc9000399f8e0 R14: ffff88803d393c00 R15: 0000000000000003 CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000000 CR3: 000000003d213000 CR4: 0000000000352ef0 DR0: 0000000039ae8f55 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace:  <TASK>  btf_type_seq_show_flags+0xca/0x120 kernel/bpf/btf.c:8250  htab_map_seq_show_elem+0x12e/0x350 kernel/bpf/hashtab.c:1669  map_seq_show+0x13d/0x1e0 kernel/bpf/inode.c:293  traverse.part.0.constprop.0+0x107/0x650 fs/seq_file.c:112  traverse fs/seq_file.c:99 [inline]  seq_read_iter+0x93f/0x1270 fs/seq_file.c:196  seq_read+0x344/0x4d0 fs/seq_file.c:163  vfs_read+0x1e4/0xb40 fs/read_write.c:572  ksys_pread64 fs/read_write.c:764 [inline]  __do_sys_pread64 fs/read_write.c:772 [inline]  __se_sys_pread64 fs/read_write.c:769 [inline]  __x64_sys_pread64+0x1eb/0x250 fs/read_write.c:769  do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]  do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84  entry_SYSCALL_64_after_hwframe+0x77/0x7f  Reject a key-less BTF in htab_map_check_btf() and rhtab_map_check_btf(), restoring the previous behavior.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 14 | 7.2.7-1 | [DEBIAN-CVE-2026-98065](https://patchblox.com/security/data/fix/linux/debian-cve-2026-98065.md) | Oct 2, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.