PT-2026-94931

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier skips rewriting the helper call offset insn-imm in bpf do misc fixups for architectures that implement bpf...

PT-2026-94934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the bpf get btf vmlinux function during the lazy parsing of vmlinux BTF BPF Type Format. The function publishes the result using a plain store and re-checks it...

PT-2026-94740

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists when reading bpf link information. In the functions bpf link show fdinfo and bpf link get info by fd, the link-prog variable is accessed without proper...

PT-2026-94908

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf cpumask populate function uses bitmap copy to write to a destination typed as struct cpumask . This allows the verifier to incorrectly...

CVE-2026-93147: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

PT-2026-94907

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where tracing multi trampolines are not marked as ftrace managed. This occurs because the tracing multi link fails to set the...

CVE-2026-92518: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

PT-2026-94617

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier fails to rewrite BPF LOAD ACQ instructions to BPF PROBE MEM loads, unlike the behavior for regular BPF LDX...

PT-2026-94933

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the bpf find vma function. The function reads task-mm and calls mmap read trylockmm without holding a reference to the memory descriptor. When processing...

PT-2026-94940

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ptr to btf access function allows btf struct access callbacks to validate write operations before the default...

PT-2026-94943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/bpf component where the ly instruction is used to load the 32-bit cpu nr value into the 64-bit BPF REG 0 register. This process fails to zero the upper bits o...

PT-2026-94944

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where BTF BPF Type Format struct walks relax struct-size checks for accesses through trailing flexible arrays. While this is...

PT-2026-94595

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A lock leak occurs in the BPF subsystem within the irq work path. The functions stack map get build id offset and bpf find vma use a per-CPU irq work to defer mmap read unlock from the...

CVE-2026-93045: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...

CVE-2026-90211: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

CVE-2026-92516: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix offset warn check for bpfresspinlock Sashiko pointed out correctly that the case statement for BPFRESSPINLOCK incorrectly checks offset for BPFSPINLOCK. Fix it by checking resspinlockoff instead...

CVE-2026-93174: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However...

Container_escape

Linux container escape PoCs Target-specific proof-of-concept...

CVE-2026-90001

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-89991

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...