CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-68399

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

UBUNTU-CVE-2026-68285

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If...

EUVD-2026-55585

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68399

CVE-2026-68399: Linux kernel BPF sock_clone UAF fixed by resetting newsk->sk_bpf_storage to NULL after sock_copy() (in sk_clone) and removing redundant init in bpf_sk_storage_clone. Exploit could lead to use-after-free of parent socket’s BPF storage with potential DoS or arbitrary code executi...

CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68399 bpf: Fix UAF in sock clone early bailouts

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 "bpf,fork: wipe -bpfstorage before bailouts that access it", skclone performs an initial shallow copy of the socket field -skbpfstorage via sockcopy...

CVE-2026-68386 bpf, sockmap: Reject unhashed UDP sockets on sockmap update

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68337

The CVE affects the Linux kernel BPF redirect helpers (bpf_redirect* and skb_do_redirect) and the bpf_net_context flow. The issue arose when a BPF program ran via tc BPF paths and accessed current->bpf_net_context unconditionally, leading to NULL dereferences. Specifically, redirects via tc qd...

CVE-2026-68337 bpf: Reject redirect helpers without a bpf_net_context

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

CVE-2026-68337 bpf: Reject redirect helpers without a bpf_net_context

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

EUVD-2026-55438

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

CVE-2026-68295 LoongArch: BPF: Zero-extend signed ALU32 div/mod results

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPFDIV and BPFMOD...

EUVD-2026-55386

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If...

CVE-2026-68285 LoongArch: BPF: Fix memory leak in bpf_jit_free()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If...

EUVD-2026-55385

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-68284

CVE-2026-68284 affects the Linux kernel BPF/sockmap path. The bug is a use-after-free in tcp_bpf_sendmsg() when two threads send on the same socket: msg_tx is compared to psock->cork while cork may have been freed, leading to freeing a stale cork. A fix ensures tmp cork is checked directly, pr...

Linux Distros Unpatched Vulnerability : CVE-2026-68284

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its erro...

Linux Distros Unpatched Vulnerability : CVE-2026-68399

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 bpf,fork: wipe -bpfstorage before bailouts that access it, skclone performs an...