PT-2026-72799

In the Linux kernel, the following vulnerability has been resolved: bpf: fix UAF by restoring RCU-delayed inode freeing in bpffs commit 4f375ade6aa9 "bpf: Avoid RCU context warning when unpinning htab with internal structs" moved inode cleanup from -free inode into -destroy inode to avoid sleepin...

PT-2026-72174

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR TO TP BUFFER and PTR TO BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

Linux Distros Unpatched Vulnerability : CVE-2026-74338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs...

Linux Distros Unpatched Vulnerability : CVE-2026-74268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: clear sockops cb flags before force-closing a child socket A child socket inherits the listener's bpfsockopscbflags via skclonelock. If its setup fails in...

Linux Distros Unpatched Vulnerability : CVE-2026-72423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks onl...

PT-2026-72741

In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 "bpf: Fix oob access in cgroup local storage" is still incomplete. The prog-array compatibility check treats a program with no cgroup storag...

PT-2026-72616

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack slot index in nospec checks check stack write fixed off computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot type with slot - i % BPF REG SIZE. The Spectre v4...

Linux Distros Unpatched Vulnerability : CVE-2026-74344

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Clear rb node linkage when freeing bpfrbroot bpfrbrootfree detaches the root by copying the current rbrootcached and then replacing the live root with...

Linux Distros Unpatched Vulnerability : CVE-2026-74354

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Take mmaplock in zappages zapvmarange requires the owning mm's mmaplock to be held. Taking mmapreadlock under arena-lock would AB-BA against arenavmclose a...

PT-2026-72693

In the Linux kernel, the following vulnerability has been resolved: sockmap: Fix use-after-free in udp bpf recvmsg syzbot reported use-after-free of struct sk msg in sk msg recvmsg. 0 sk msg recvmsg peeks sk msg from psock-ingress msg under a lock, but its processing is lockless. Thus, sk msg...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-72590

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print bpf insn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF PSEUDO MAP FD and BPF PSEUDO MAP VALUE...

PT-2026-72540

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: Fix hid bpf get data range check hid bpf get data returns a pointer into the HID-BPF context data when the caller-provided offset and size fit inside ctx-allocated size. The current check adds rdwr buf size and offset...

PT-2026-72301

In the Linux kernel, the following vulnerability has been resolved: io uring/bpf-ops: reject re-registration of an already-bound ops io install bpf only rejects a second registration on the ctx side ctx-bpf ops and sets the per-map back-pointer ops-priv unconditionally. The struct ops link path...

PT-2026-72692

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf msg pop data bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l ||...

PT-2026-72750

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf obj free fields when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete...

PT-2026-72800

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with excl prog hash is bound to a single program by hash: check map prog compatibility refuses to load any program whose digest does not match map-ex...

PT-2026-72790

In the Linux kernel, the following vulnerability has been resolved: bpf: Take mmap lock in zap pages zap vma range requires the owning mm's mmap lock to be held. Taking mmap read lock under arena-lock would AB-BA against arena vm close and arena map mmap, both of which run with mmap write lock he...

PT-2026-72588

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6 validate srh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6 sr hdr fields. The BPF SEG6 enca...

Linux Distros Unpatched Vulnerability : CVE-2026-74258

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Guard getuser acesss with accessok for uprobemulti data As reported by sashiko 1 we need to use accessok to check the user space data bounds before we use...