CVE-2026-90300

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. The bpfgettaskstack helper function, used by bpfgettaskstack and bpfgettaskstacksleepable, fails to clear a buffer buf on error paths. This oversight can lead to non-deterministic buffer contents, potentially resulting i...

CVE-2026-90159

A flaw was found in the Linux kernel. Specifically, a concurrency vulnerability exists within the Berkeley Packet Filter BPF subsystem when handling cgroup UNIX getname hooks. This issue arises because certain BPF functions, bpfsetsockopt and bpfgetsockopt, are called without first acquiring a...

CVE-2026-98384

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When processing socket destruction requests through the bpfsockdestroy helper, the kernel fails to properly verify if a socket is a full socket before attempting to read its protocol field, causing an out-of-bounds memor...

CVE-2026-98378

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. A local attacker can trigger a use-after-free flaw by iterating over BPF links while a concurrent link creation operation fails. This issue occurs because the iterator references links before their initialization is...

cve-2024-23113-poc

CVE-2024-23113-poc CVE-2024-23113 is a vulnerability discovered in the Linux Kernel , classified as an arbitrary code execution vulnerability that affects the bpf Berkeley Packet Filter subsystem. Specifically, this vulnerability affects objects of the bpfprog type in bpf programs, and can allow ...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed a UAF by restoring the RCU-delayed inode during bpfanyput. The commit “4f375ade6aa9” “bpf: Avoid RCU context warnings when unpinning htab with internal structs” moved the inode cleanup from -freeinode to -destroyino...

CVE-2026-98075

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. When a BPF program references its main function as a callback, the kernel fails to translate the function reference into a valid memory address. A local user with permissions to load BPF programs could exploit this...

CVE-2026-98065

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user can cause a Denial of Service DoS by creating a hash map lacking key type information and reading it through the BPF file system. Due to missing validation of BPF Type Format BTF metadata, the kernel attempt...

CVE-2026-98059

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. This issue allows a local attacker to cause a Denial of Service DoS through a system crash. The vulnerability occurs because the BPF verifier fails to recognize that process-wait tracepoint arguments can be null,...

CVE-2026-98058

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain internal helper functions that pause execution to perform blocking operations were not properly marked as sleepable. A local user with permissions to load BPF programs can invoke these functions within...

CVE-2026-98045

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these...

CVE-2026-98038

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When validating programs that manage shared reference-counted objects, the BPF verifier incorrectly treats borrowed references as always valid and fails to require null-pointer checks. A local user can exploit this...

CVE-2026-98036

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. A local user with permission to run BPF programs can trigger a use-after-free condition, potentially leading to a system crash, denial of service DoS, or privilege escalation. This flaw occurs during the recycling of...

CVE-2026-98035

A flaw was found in the Linux kernel's BPF subsystem. When updating or deleting elements in resizable hash tables, the kernel directly releases special object fields rather than safely deferring their cancellation, which is not safe when running in Non-Maskable Interrupt NMI context. A local user...

CVE-2026-98033

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. The kernel's program verifier improperly resets tracking identifiers when preparing callback functions, causing it to confuse different internal data structures sharing the same template. A local user with permission to...

PT-2026-98831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the bpf refcount field is not marked as unique. This oversight relates to how reference counts are tracked for BPF...

PT-2026-94565

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier fails to properly compare iterator types during state pruning. Specifically, iterator stack slots can be...

PT-2026-94525

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding atomic Read-Modify-Write RMW verification. The system only records the instruction pointer type when the destination...

PT-2026-94595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A lock leak occurs in the BPF subsystem within the irq work path. The functions stack map get build id offset and bpf find vma use a per-CPU irq work to defer mmap read unlock from the...

PT-2026-94970

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where per-CPU map elements are stored using a rounded size, but the copy map value long function passes only the map-value size to bpf obj memcpy. Wh...