[SECURITY] Fedora 42 Update: bpfman-0.5.4-6.fc42

bpfman operates as an eBPF manager, focusing on simplifying the deployment and administration of eBPF programs...

[SECURITY] Fedora 42 Update: rust-scx_layered-0.0.6-8.fc42

A highly configurable multi-layer BPF / user space hybrid scheduler used within schedext, which is a Linux kernel feature which enables implementing kernel thread schedulers in BPF and dynamically loading them. https://github.com/sched-ext/scx/tree/main...

[SECURITY] Fedora 42 Update: rust-scx_rusty-0.5.4-8.fc42

A multi-domain, BPF / user space hybrid scheduler used within schedext, which is a Linux kernel feature which enables implementing kernel thread schedulers in BPF and dynamically loading them. https://github.com/sched-ext/scx/tree/main...

PT-2026-29719

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UaF issue was identified in the netfilter component of the Linux kernel related to the handling of BPF hooks. Specifically, the vulnerability occurs when dumping hooks v...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the delayed memory release by netfilter BPF, potentially leading to reused memory after release...

kernel: Linux kernel: Use-after-free in BPF sockmap can lead to denial of service and privilege escalation

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter sockmap subsystem. A race condition exists where the sksocket is not properly locked or referenced during the skbsendsock function call, allowing for a use-after-free vulnerability. This can be exploited by a local attacker, leadin...

[SECURITY] Fedora 44 Update: rust-scx_rustland-0.0.3-8.fc44

A BPF component dispatcher that implements the low level sched-ext functionalities and a user-space counterpart scheduler, written in Rust, that implements the actual scheduling policy. This is used within schedext, which is a Linux kernel feature which enables implementing kernel thread schedule...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1495)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1495 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: schqfq: Fix null-deref in aggdequeue CVE-2025-40083 In the Linux kernel, the following vulnerability has been...

CVE-2026-33726

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is...

CVE-2026-33726 Cilium L7 proxy may bypass Kubernetes NetworkPolicy for same-node traffic

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is...

CVE-2026-33726

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.17.14, 1.18.8, and 1.19.2, Ingress Network Policies are not enforced for traffic from pods to L7 Services Envoy, GAMMA with a local backend on the same node, when Per-Endpoint Routing is...

The vulnerability of the prepare_trampoline() function in the arch/arm64/net/bpf_jit_comp.c network support module on the ARM 64-bit kernel platform of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the preparetrampoline function in the arch/arm64/net/bpfjitcomp.c network support module on the ARM 64-bit kernel of the Linux operating system is related to the improper disabling or release of resources. Exploiting this vulnerability can allow an attacker to cause a service...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix use-after-free in pagepoolrecycleinring CVE-2025-38129 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper CVE-2025-40110 In th...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the ciltocontainer and bpflxc local-backend packet path in the datapath components. An attacker can bypass ingress network policies and reach a local backend pod by sending traffic through an L7 load...

Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-50453: gpiolib: cdev: fix NULL-pointer dereferences bsc1250887. CVE-2023-53794: cifs: fix session state check in reconnect to avoid use-after-free issue...

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

...

bpf: Fix stack-out-of-bounds write in devmap

...

The vulnerability of the __cpu_map_ring_cleanup() function in the kernel/bpf/cpumap.c module, which is part of the Linux operating system’s BPF interpreter support, allows a malicious actor to cause a service failure.

The vulnerability of the cpumapringcleanup function in the kernel/bpf/cpumap.c module, which is part of the Linux kernel’s BPF interpreter support, is related to incorrect code validation for function return operations. Exploiting this vulnerability could allow an attacker to trigger a service...

The vulnerability of the `tcp_bpf_send_verdict()` function in the `net/ipv4/tcp_bpf.c` module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcpbpfsendverdict function in the net/ipv4/tcpbpf.c module of the Linux kernel is related to the repeated release and reuse of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

The vulnerability of the `tcp_bpf_sendmsg_redir()` function in the `net/ipv4/tcp_bpf.c` module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcpbpfsendmsgredir function in the net/ipv4/tcpbpf.c module of the Linux kernel is related to the repeated release of memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...