CVE-2026-63865

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop tasktoinode and inetconnestablished from lsm sleepable hooks bpflsmtasktoinode is called under rcureadlock and bpflsminetconnestablished is called from softirq context, so neither hook can be used by sleepable LSM...

EUVD-2026-45699

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpfmsgpushdata When bpfmsgpushdata inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is...

CVE-2026-63865 bpf: Drop task_to_inode and inet_conn_established from lsm sleepable hooks

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop tasktoinode and inetconnestablished from lsm sleepable hooks bpflsmtasktoinode is called under rcureadlock and bpflsminetconnestablished is called from softirq context, so neither hook can be used by sleepable LSM...

CVE-2026-63865

Technical details are not publicly available in the provided documents. Monitor for updates from vendors and security advisories to obtain affected products, impact, and remediation.

EUVD-2026-45548

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

CVE-2026-63864

The CVE affects the Linux kernel BPF tail-call path. Root cause: visit_tailcall_insn() was added without checking its return value, creating an unchecked error path in tail calls. A fix was applied in commit e40f5a6bf88a to correct stack liveness and propagate the error from visit_tailcall_insn()...

CVE-2026-63864 bpf: Propagate error from visit_tailcall_insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

EUVD-2026-45496

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The skmsg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells skmsgcomputedatapointers not to expose the entry through writable BPF ctx-data. This...

CVE-2026-63830

The CVE-2026-63830 entry describes a Linux kernel vulnerability in net: skmsg where the sg.copy bitmap could become unsynchronized with sg.data[] during various sk_msg transforms, potentially allowing writable exposure to page cache data via BPF ctx->data. The issue covers transformations like...

CVE-2026-63830 net: skmsg: preserve sg.copy across SG transforms

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The skmsg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells skmsgcomputedatapointers not to expose the entry through writable BPF ctx-data. This...

CVE-2026-63809

CVE-2026-63809 affects the Linux kernel memory-management path used by BPF when handling proc sysctl writes. The vulnerability stems from proc_sys_call_handler() allocating a temporary sysctl buffer with kvzalloc() and passing it to __cgroup_bpf_run_filter_sysctl(); since kvzalloc() may fall back...

CVE-2026-63809 bpf: use kvfree() for replaced sysctl write buffer

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

Linux Distros Unpatched Vulnerability : CVE-2026-63809

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysct...

oci-seccomp-bpf-hook security update

An update is available for oci-seccomp-bpf-hook. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OCI Hook to generate seccomp json files based on EBF syscalls us...

RockyLinux 9 : oci-seccomp-bpf-hook (RLSA-2026:36617)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:36617 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block direct...

AlmaLinux 9 : oci-seccomp-bpf-hook (ALSA-2026:36617)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:36617 advisory. net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME CVE-2026-33811 Tenable has extracted the preceding description block directl...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: CVE-2025-40216: iouring/rsrc: don't rely on user vaddr alignment bsc1259764. CVE-2025-40341: futex: Don't leak robustlist pointer on exec race bsc1255029. CVE-2025-71294:...

SUSE-SU-2026:2800-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2025-40216: iouring/rsrc: don't rely on user vaddr alignment bsc1259764. - CVE-2025-40341: futex: Don't leak robustlist pointer on exec race bsc1255029. -...

RHEL 9 : oci-seccomp-bpf-hook (RHSA-2026:36617)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:36617 advisory. OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to...