CVE-2026-98044

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98045

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-98047

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

DEBIAN-CVE-2026-98044

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

AZL-104324 CVE-2026-98043 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

AZL-104184 CVE-2026-98044 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98043

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

DEBIAN-CVE-2026-98045

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

DEBIAN-CVE-2026-98047

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

DEBIAN-CVE-2026-98043

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

DEBIAN-CVE-2026-98049

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98046

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

CVE-2026-98049

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

DEBIAN-CVE-2026-98041

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...

CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

AZL-104498 CVE-2026-98034 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise checkmapkptraccess permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it...

CVE-2026-98035

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtabmapupdateexisting and rhtabdeleteelem call bpfobjfreefields when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where...

CVE-2026-98036

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes special fields after obtaining an element from bpfmemcachealloc. The allocator can return a fresh, zeroed unit, or recycle one from its...

CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

CVE-2026-98041

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...