CVE-2026-98045

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these...

CVE-2026-98038

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When validating programs that manage shared reference-counted objects, the BPF verifier incorrectly treats borrowed references as always valid and fails to require null-pointer checks. A local user can exploit this...

CVE-2026-98036

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user with permission to run BPF programs can trigger a use-after-free condition, potentially leading to a system crash, denial of service DoS, or privilege escalation. This flaw occurs during the recycling of...

CVE-2026-98035

A flaw was found in the Linux kernel's BPF subsystem. When updating or deleting elements in resizable hash tables, the kernel directly releases special object fields rather than safely deferring their cancellation, which is not safe when running in Non-Maskable Interrupt NMI context. A local user...

CVE-2026-98033

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. The kernel's program verifier improperly resets tracking identifiers when preparing callback functions, causing it to confuse different internal data structures sharing the same template. A local user with permission to...

PT-2026-98831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the bpf refcount field is not marked as unique. This oversight relates to how reference counts are tracked for BPF...

PT-2026-94907

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where tracing multi trampolines are not marked as ftrace managed. This occurs because the tracing multi link fails to set the...

PT-2026-94559

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem on s390 architecture where a Read-Modify-Write RMW atomic operation on an arena pointer fails to clear the destination register during a fault over a...

PT-2026-94706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem on x86 architectures where the trampoline stack size is incorrectly calculated for 128-bit arguments. The btf distill func proto function accepts...

PT-2026-94525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding atomic Read-Modify-Write RMW verification. The system only records the instruction pointer type when the destination...

PT-2026-94970

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where per-CPU map elements are stored using a rounded size, but the copy map value long function passes only the map-value size to bpf obj memcpy. Wh...

PT-2026-94595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A lock leak occurs in the BPF subsystem within the irq work path. The functions stack map get build id offset and bpf find vma use a per-CPU irq work to defer mmap read unlock from the...

PT-2026-94660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the check atomic load function calls check load mem before atomic ptr type ok. In scenarios where a load-acquire operation fetches data into it...

PT-2026-94565

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier fails to properly compare iterator types during state pruning. Specifically, iterator stack slots can be...

PT-2026-94921

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the check kfunc args function fails to bound kfunc arguments named rdonly buf size or rdwr buf size. These values are stored in meta-r0 size a...

PT-2026-94908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf cpumask populate function uses bitmap copy to write to a destination typed as struct cpumask . This allows the verifier to incorrectly...

PT-2026-94940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ptr to btf access function allows btf struct access callbacks to validate write operations before the default...

PT-2026-94793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the trampoline could be corrupted due to the incorrect assignment of tr-flags in the verifier. When a fexit is attached to a tail call reachabl...

PT-2026-94824

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the case statement for BPF RES SPIN LOCK incorrectly validates the offset using the logic intended for BPF SPIN LOCK. Th...

PT-2026-94690

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A deadlock occurs in the BPF subsystem when the arena vm fault function fails to acquire the arena-spinlock. The function returns VM FAULT RETRY, which triggers the do user addr fault pa...