CVE-2026-98060: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

ROS-20260925-73-0148

The vulnerability of the BTFID function in the kernel/bpf/verifier.c module, which is part of the BPF interpreter support for Linux’s operating system, is related to an uncontrolled recursion. Exploiting this vulnerability could allow a attacker to cause a service failure...

ROS-20260925-73-0179

The vulnerability of the bpf component in the Linux operating system’s kernel is related to insufficient checking of the type of input data provided. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-98042

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collectlinkedregs checkcondjmpop copies the compared registers into env-false,truereg1,2 before collectlinkedregs runs and copies those snapshots back into both branch states afterwards...

CVE-2026-98038: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcountacquire nullable for borrowed RCU kptrs bpfrefcountacquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KFRETNULL on the return value...

CVE-2026-98039: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

CVE-2026-98037: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

CVE-2026-98134: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98134

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98033: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore mapptr. This clears mapuid, which is the only field distinguishing inn...

CVE-2026-98084: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

Linux Distros Unpatched Vulnerability : CVE-2026-98007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such...

PT-2026-98724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where tail calls made directly from callback frames are not properly handled. When a tail call occurs from a non-zero frame, t...

PT-2026-98697

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the check map kptr access function allows a scalar store into an untrusted kptr field if the register is known to contain zero, but fails to ma...

PT-2026-98702

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the map kptr match type function fails to require the source register to carry the MEM PERCPU flag when storing into a BPF KPTR PERCPU field...

PT-2026-98703

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the check cond jmp op function incorrectly handles NULL checks for nullable pointers. When a comparison is made between a nullable pointer rA a...

PT-2026-98707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ld abs function models failed BPF LD ABS or BPF LD IND instructions in a subprogram as an implicit return with...

PT-2026-98709

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf btf find by name kind function is not correctly marked as sleepable. When this function finds a type in module BTF, it calls btf new fd...

PT-2026-98710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the in rbtree lock required cb function only checks the innermost verifier frame. When bpf rbtree add invokes its comparator while holding the...

PT-2026-98721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf sys bpf and bpf sys close functions are not correctly marked as sleepable. The bpf sys bpf function executes the bpf2 syscall body, whi...