Detections
Analytics

Chainguard: linux-desktop-7.2-bootc: security update to 7.2.7-r0

medium Tenable Cloud Security Plugin ID 474665

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: bpf: check_cond_jmp_op(): properly
 infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a
 pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o
 PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example: // `a` is
 PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED // `a` is 0 at runtime. // `b` is PTR_TO_MAP_VALUE |
 PTR_MAYBE_NULL void *a = bpf_rdonly_cast(0, 0); int *b = bpf_map_lookup_elem(...); if (a == b) *b = 42; //
 verifier does not catch null pointer dereference This happens because of a special case in
 check_cond_jmp_op(), which attempts to strip PTR_MAYBE_NULL flags from pointer types, when processing
 comparisons like `rA == rB`, if either rA or rB can't be null. The non-null property is derived based on
 the absence of PTR_MAYBE_NULL flag on rA's or rB's type. But that is not sufficient for types like
 PTR_TO_MEM, as in the example. This patch replaces type_may_be_null() call with reg_not_null(), which
 contains an allowlist of types for which absence of PTR_MAYBE_NULL actually means that the value can't be
 NULL at runtime. At the moment, the list in the reg_not_null() omits two types for which PTR_MAYBE_NULL is
 applicable: PTR_TO_XDP_SOCK and PTR_TO_BUF. In order to remain backward compatible, and assuming that only
 comparison between pointers of the same type makes sense, this commit extends reg_not_null(). W/o such an
 extension e.g. verifier_jeq_infer_not_null/null_ptr_to_map_value fails. reg_not_null() can be extended
 further, but I deem that out of scope for the fix at hand. Explicit base_type(...) != PTR_TO_BTF_ID checks
 in the check_cond_jmp_op() can be removed with migration to reg_not_null(), but that is a behavioural
 change, as the special case would start matching for PTR_TO_BTF_ID that is also is_trusted_reg(). I omit
 the behavioural change from this commit. (CVE-2026-98134)

Solution

Update the linux-desktop-7.2-bootc library and its related packages to version 7.2.7-r0 or later.

Plugin Details

Severity: Medium

ID: 474665

Version: Revision 1.1

Type: Local

Published: 10/16/2026

Updated: 10/16/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.68

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-98134

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 9/25/2026

Reference Information

CVE: CVE-2026-98134