PT-2026-72807

In the Linux kernel, the following vulnerability has been resolved: bpf: fix BPF PROG QUERY OOB write and cgroup backward compat BPF PROG QUERY writes back the 'query.revision' field unconditionally to userspace. If userspace passes a smaller 'bpf attr' structure e.g. 40 bytes, which was the layo...

PT-2026-72611

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts sz argument. The verifier checks only the memory range described by opts sz, but the wrappers...

PT-2026-72799

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -free inode into -destroy inode to avoid sleepin...

PT-2026-72818

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls bpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in cls bpf offload cmd. Reproducer on netdevsim: add a skip sw cls bpf filter, set the bpf tc accept debugfs knob to 0, then...

Linux Distros Unpatched Vulnerability : CVE-2026-72111

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls...

PT-2026-72616

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check stack write fixed off computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot type with slot - i % BPF REG SIZE. The Spectre v4...

PT-2026-72741

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

PT-2026-72174

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR TO TP BUFFER and PTR TO BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

Linux Distros Unpatched Vulnerability : CVE-2026-74344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with...

Linux Distros Unpatched Vulnerability : CVE-2026-74268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in...

Linux Distros Unpatched Vulnerability : CVE-2026-74338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs...

Linux Distros Unpatched Vulnerability : CVE-2026-72423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks onl...

PT-2026-72692

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf msg pop data bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l ||...

PT-2026-72800

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with excl prog hash is bound to a single program by hash: check map prog compatibility refuses to load any program whose digest does not match map-ex...

PT-2026-72790

In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmap lock in zap pages zap vma range requires the owning mm's mmap lock to be held. Taking mmap read lock under arena-lock would AB-BA against arena vm close and arena map mmap, both of which run with mmap write lock he...

PT-2026-72588

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6 validate srh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6 sr hdr fields. The BPF SEG6 enca...

PT-2026-72694

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard get user acesss with access ok for uprobe multi data As reported by sashiko 1 we need to use access ok to check the user space data bounds before we use get-user to get it. 1...

PT-2026-72300

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check mem access When the BPF verifier processes a context load of an LSM hook return value, it calls mark reg s32 range to narrow the register to the hook's valid range...

PT-2026-72590

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print bpf insn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF PSEUDO MAP FD and BPF PSEUDO MAP VALUE...

PT-2026-72540

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid bpf get data range check hid bpf get data returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocated size. The current check adds rdwr buf size and offset...