4984 matches found
CVE-2026-74720
A flaw was found in the Linux kernel's Berkeley Packet Filter BPF component. When a scalar value is added to a pointer during certain arithmetic operations, the system fails to fully preserve the pointer's state. This inconsistency in how the pointer's origin and properties are tracked can lead t...
CVE-2026-74590
A flaw was found in the Linux kernel's fsverity subsystem. A local attacker could exploit a race condition in the bpfgetfsveritydigest function by concurrently modifying its digestsize argument. This could lead to a system crash, resulting in a denial of service...
CVE-2026-74589
A flaw was found in the Linux kernel's Berkeley Packet Filter BPF sockmap feature. A use-after-free vulnerability exists in the skredir mechanism within the tcpbpfsendmsgredir function. This occurs when a socket reference is prematurely released while another thread still holds a raw pointer to i...
CVE-2026-74715
A flaw was found in the kernel. A reference imbalance vulnerability exists in the Berkeley Packet Filter BPF conntrack kfuncs. This occurs when the 'opts' argument, which can point to a shared map value, has its network namespace identifier netnsid read separately during reference acquisition and...
SUSE CVE-2026-74589
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...
SUSE CVE-2026-74590
In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpfgetfsveritydigest dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of...
CVE-2026-74714
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...
CVE-2026-74720
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...
CVE-2026-74715
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74590
In the Linux kernel, the following vulnerability has been resolved: fsverity: Fix bpfgetfsveritydigest dynptr assumptions The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of...
CVE-2026-74589
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...
CVE-2026-74720 bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...
CVE-2026-74720 bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...
EUVD-2026-64407
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...
CVE-2026-74720
CVE-2026-74720 affects the Linux kernel BPF verifier , specifically the adjust_ptr_min_max_vals() function. When handling the commuted arithmetic operation scalar += pointer, the destination register inherits pointer state from the source pointer by copying only selected fields. This is fragile b...
CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74715
This vulnerability affects the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The root cause is a race condition : the opts->netns_id field is read separately when acquiring and releasing the network namespace reference. Because opts can point to a shar...
EUVD-2026-64402
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74714
CVE-2026-74714 is a use-after-free in the Linux kernel's bpf_iter_tcp_established_batch() function. The root cause is a race condition: when a TCP request_sock is being published onto the ehash chain, its refcount is still zero until after the bucket lock is dropped. The BPF TCP iterator calls pl...