CVE-2026-98007

The Linux kernel contains a vulnerability in the bpf_loop() helper function where the nr_loops argument is incorrectly declared as ARG_ANYTHING. This allows privileged programs to pass pointer values instead of scalars. Because the verifier marks these registers as precise, passing a pointer trig...

EUVD-2026-86660

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...