PT-2026-94660

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the check atomic load function calls check load mem before atomic ptr type ok. In scenarios where a load-acquire operation fetches data into it...

CVE-2026-90299: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

PT-2026-94741

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the bpf netns link update prog function. The issue occurs because checks for old prog and program type are performed without locking before the netns bpf mutex...

PT-2026-94794

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subprograms where a Control Flow Integrity CFI mismatch occurs during task work callbacks. While BPF subprograms utilize the bpf callback t ABI, task work...

PT-2026-94841

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF interpreter where it fails to recognize the BPF JMP|BPF JA|BPF X instruction used for insn array maps. This failure leads to a kernel BUG triggered by the BUG ...

PT-2026-94842

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the interpreter does not support arena-related instructions. When the interpreter executes arena ST, LDX, or STX...

PT-2026-94943

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the s390/bpf component where the ly instruction is used to load the 32-bit cpu nr value into the 64-bit BPF REG 0 register. This process fails to zero the upper bits o...

CVE-2026-90392: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential UAF when reading bpf link info In bpflinkshowfdinfo and bpflinkgetinfobyfd, link-prog is accessed without holding any locks. If the prog is concurrently replaced via bpflinkupdate, the old prog can be freed,...

Container_escape

Linux container escape PoCs Target-specific proof-of-concept...

CVE-2026-90001

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-89991

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix infinite loop in pcpufreelist push with one possible CPU pcpufreelistpush can loop forever when only one CPU is possible and an NMI re-enters pcpufreelistpush while the interrupted context holds that CPU's freelist lock...

AZL-101568 CVE-2026-89906 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

DEBIAN-CVE-2026-89905

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

CVE-2026-89902

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Avoid preempt count underflow without probe LoongArch uses break 11 for the breakpoint placed after an instruction that Kprobes executes out of line. Since userspace can issue the same break instruction, dobp can reach...

CVE-2026-89905

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Move arena register slot below TCC context Currently, the stack layout places the optional arena register slot above the tail call counter context. When arenavmstart is dynamically enabled, it shifts the relative...

CVE-2026-89906

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

EUVD-2026-80609

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90001 HID: bpf: serialize device reference release in struct_ops destroy path

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: serialize device reference release in structops destroy path hidbpfopsdestroydevice and hidbpfunreg can race on the same registration reference, double-putting struct hiddevice and freeing it while hiddestroydevice stil...

CVE-2026-90001

A race condition in the Linux kernel HID BPF subsystem allows __hid_bpf_ops_destroy_device() and hid_bpf_unreg() to double-put the struct hid_device reference, freeing the device while hid_destroy_device() is still using it. The root cause is a TOCTOU flaw: the two paths run under different lock ...

CVE-2026-89906 LoongArch: BPF: Refactor jump offset calculation in tail call

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...