CVE-2025-38502-Linux-LPE

Abraxas Labs · abraxaslabs.tech · github.com/abraxas · @abraxasnull CVE-2025-38502 Linux 内核 BPF cgroup 本地存储通过尾调用导致的越界访问 | ---|--- CVE| CVE-2025-38502 CWE| CWE-125 — 越界读取 厂商| Linux 内核 组件| kernel/bpf/core.c、include/linux/bpf.h（cgroup 本地存储 + 尾调用） 影响| 本地内核内存破坏；在未打补丁的内核上，权限提升在影响范围内 攻击向量| 本地（AV:L） 所需权限...

Linux Distros Unpatched Vulnerability : CVE-2026-90065

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock clcsock from the proto-init hook. Wh...

CVE-2026-90313

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

AZL-102347 CVE-2026-90250 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

DEBIAN-CVE-2026-90250

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

DEBIAN-CVE-2026-90065

In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock "clcsock" from the proto-init hook. When socket creation fails after proto-init has run - e.g. a cgroup B...

CVE-2026-90313

CVE-2026-90313 affects the Linux kernel BPF/cgroup subsystem. When a cgroup BPF program is replaced using BPF_F_REPLACE and the replacement fails midway (e.g., in bpf_trampoline_link_cgroup_shim or update_effective_progs), the cleanup path frees the new storage but fails to restore pl->storage...

EUVD-2026-81843

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

EUVD-2026-81750

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

PT-2026-94413

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/smc component where IPPROTO SMC sockets fail to release an internal TCP sock, referred to as clcsock, when socket creation fails after the proto-init hook has...

CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

CVE-2026-89902 LoongArch: Avoid preempt count underflow without probe

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

Exploit for Out-of-bounds Read in Linux Linux_Kernel

Abraxas Labs ·...

The vulnerability of the __cgroup_bpf_run_filter_sysctl() function in the kernel/bpf/cgroup.c module, which supports the BPF interpreter for Linux kernels, allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the cgroupbpfrunfiltersysctl function in the kernel/bpf/cgroup.c module, which supports the BPF interpreter for Linux kernels, is related to the release of an incorrect pointer. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity...

SUSE CVE-2026-74305

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, cgroup: Fixed a kernel bug in purgeeffectiveprogs Syzkaller reported a triggered kernel bug as follows: ------------ Cut here ----------- Kernel bug at kernel/bpf/cgroup.c:925! Invalid opcode: 0000 1 PREEMPT SMP NOPTI CPU...

CVE-2026-72427

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter cgroup program handling. Incorrect indexing in the replaceeffectiveprog and purgeeffectiveprogs functions, particularly when BPFFPREORDER programs are active, can lead to memory corruption. This issue can result in overwriting...

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-006899)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-006899 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix kernel BUG in purgeeffectiveprogs Syzkaller reported a triggered kernel BUG as...