CVE-2026-98134 bpf: check_cond_jmp_op(): properly infer if register is null

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98132 bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

CVE-2026-98132

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

CVE-2026-98132

A flaw exists in the Linux kernel 's Berkeley Packet Filter (BPF) verifier, specifically within the states.c:__clean_func_state() function. The vulnerability occurs when the verifier incorrectly downgrades a half-dead scalar zero spill to STACK_ZERO because a portion of the stack memory is consid...

EUVD-2026-86963

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

CVE-2026-98132 bpf: don't downgrade half-dead scalar zero spills to STACK_ZERO

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

CVE-2026-98085

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98085

The Linux kernel contains a vulnerability in the BPF precision backtracking mechanism affecting BPF_LD | BPF_{IND,ABS} instructions. The root cause is that the backtrack_insn() function fails to handle the implicit exit case from a subprogram. Specifically, it does not call bt_subprog_enter() whe...

CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98084 bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

CVE-2026-98084

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

EUVD-2026-86914

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

CVE-2026-98075

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

CVE-2026-98075 bpf: reject BPF_PSEUDO_FUNC reference to the main program

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

EUVD-2026-86905

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

CVE-2026-98075

The Linux kernel contains a vulnerability where the fixups.c:jit_subprogs() function fails to rewrite BPF_PSEUDO_FUNC loads for the main program when env->subprog_cnt is not greater than 1. This allows a program to reference the main function as a callback (e.g., via bpf_timer_set_callback()),...

CVE-2026-98075 bpf: reject BPF_PSEUDO_FUNC reference to the main program

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

CVE-2026-98065

The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...

CVE-2026-98065 bpf: Reject key-less BTF for hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...