CVE-2026-98062 bpf: Mark signal tracepoint siginfo arguments as scalar

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

CVE-2026-98060

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

CVE-2026-98060 bpf: Reject resilient lock operations in rbtree callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

CVE-2026-98060

The Linux kernel contains a vulnerability in the BPF subsystem where the resilient lock kfunc argument path fails to enforce a rule regarding rbtree callbacks . Specifically, because __bpf_rbtree_add() keeps parent and link pointers live during comparison callbacks, the root's lock must remain he...

EUVD-2026-86713

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

CVE-2026-98060 bpf: Reject resilient lock operations in rbtree callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

CVE-2026-98059 bpf: Mark sched_process_wait argument as nullable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

EUVD-2026-86711

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

EUVD-2026-86712

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

CVE-2026-98059

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

CVE-2026-98059

The Linux kernel contains a vulnerability where the sched_process_wait tracepoint argument is not correctly marked as nullable. Specifically, kernel_wait4() and kernel_waitid_prepare() can leave wo_pid as NULL . Because btf_ctx_access() types this argument as PTR_TRUSTED without PTR_MAYBE_NULL, t...

CVE-2026-98058 bpf: Mark syscall helpers as sleepable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

CVE-2026-98059 bpf: Mark sched_process_wait argument as nullable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

CVE-2026-98049 bpf: zero extend the result of an arena 32-bit cmpxchg

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98049 bpf: zero extend the result of an arena 32-bit cmpxchg

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

EUVD-2026-86702

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98049

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98049

A vulnerability exists in the Linux kernel BPF (Berkeley Packet Filter) subsystem where the is_cmpxchg_insn() function fails to match BPF_PROBE_ATOMIC mode. When performing a 32-bit atomic compare-and-exchange operation on an arena pointer, the kernel fails to emit an explicit zero extension for ...

CVE-2026-98047 bpf: Check ancestor frames for rbtree callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

CVE-2026-98047 bpf: Check ancestor frames for rbtree callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...