Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject unhashed sockets in bpfskassign The semantics for bpfskassign are as follows: c sk = somelookupfunc bpfskassignskb, sk bpfskreleasesk That is, the sk is not consumed by bpfskassign. Therefore, the function must ensure...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: There is a race condition where irqwork can be queued in bpfringbufcommit, but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to schedswitch triggers bpfringbufcommit, whi...

Astra Linux – Vulnerabilities in Linux-6.1, Linux-5.15, Linux-5.10

In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Added BHB mitigation to the epilogue for cBPF programs. A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. Upon exiting a cBPF program, the BHB...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insufficient bounds propagation from adjustscalarminmaxvals Kuee reported a corner case where the tnum becomes constant after the call to regboundoffset, but the bounds of the register are not correct. In particular, its...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Forgetting ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation in the following BPF program. 0: call bpfgetnetnscookie 1: if r0 == 0 goto 2: if r0 & Oxffffffff goto The...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed the requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was performing a socket lookup, taking a reference count of the socket. It w...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF, sockmap: Prevent lock inversion deadlock in mapdeleteelem operation. The syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Since BPF tracing programs can be invoked fr...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed the memory leak in bpfskselectreuseport As pointed out in the original comment, a lookup in sockmap can return a TCP ESTABLISHED socket. Such a TCP socket may have had SOATTACHREUSEPORTEBPF set before it became...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Fixed a potential memory leak related to jitdata. Make sure that jitdata is freed through kfree in the error path...

CVE-2026-68337

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject redirect helpers without a bpfnetcontext The bpfredirect helpers and skbdoredirect obtain the per-task bpfredirectinfo via bpfnetctxgetri, which dereferences the current-bpfnetcontext unconditionally. That context is...

CVE-2026-68295

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPFDIV and BPFMOD...

CVE-2026-68295 LoongArch: BPF: Zero-extend signed ALU32 div/mod results

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPFDIV and BPFMOD...

CVE-2026-68295

In the Linux kernel, LoongArch BPF ALU32 division/modulo results were sign-extended in the JIT, causing upper 32 bits to be set while verifier/interpreter assume zero-extension. The issue arises when signed ALU32 BPF_DIV/BPF_MOD (off=1) produce a negative quotient/remainder, leaving bits 63:32 se...

EUVD-2026-55396

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPFDIV and BPFMOD...

CVE-2026-68285

The CVE concerns LoongArch BPF in the Linux kernel. Root cause: during JIT compilation, bpf_int_jit_compile() may return early on the first pass, leaving ctx->offset alive; if a later subprogram fails, bpf_jit_free() does not free jit_data->ctx.offset, causing a memory leak of the JIT conte...

CVE-2026-68285 LoongArch: BPF: Fix memory leak in bpf_jit_free()

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Enabling exception fixup for specific ADE subcodes This patch enables the LoongArch BPF JIT to handle recoverable memory access errors generated by BPFPROBEMEM instructions. When a BPF program performs memory access...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: BPF: Freeing special fields when updating lru,percpuhash maps Since lru,percpuhash maps support BPFKPTRREF,PERCPU, missing calls to ‘bpfobjfreefields’ in ‘pcpucopyvalue’ could cause the memory referenced by BPFKPTRREF,PERCPU fiel...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Narrow access to the pointer ctx fields is now rejected. The following BPF program, simplified from a syzkaller repro, causes a kernel warning: c r0 = u8 r1 + 169; exit; Here, the pointer field sk is located at offset 168 in...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the bpf and arm64 architectures, there is a vulnerability where forced 8-byte alignment of the JIT buffer is required to prevent atomic tearing. The struct bpfplt structure contains a u64 target field. Currently, the BPF JIT...