PT-2026-98705

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where check cond jmp op copies compared registers into env-false,true reg1,2 before collect linked regs executes, subsequently copying those snapshot...

PT-2026-98706

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the reg not null function incorrectly determines if a register holds a non-NULL value by relying solely on its type. For pointer types that all...

PT-2026-98707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the check ld abs function models failed BPF LD ABS or BPF LD IND instructions in a subprogram as an implicit return with...

PT-2026-98708

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Faultable variants of the functions bpf get stack and bpf get task stack pass may fault=true into common stack collection code. This process can trigger build id parse file when resolvin...

PT-2026-98710

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the in rbtree lock required cb function only checks the innermost verifier frame. When bpf rbtree add invokes its comparator while holding the...

PT-2026-98712

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the is cmpxchg insn function only matches BPF ATOMIC mode. When bpf convert ctx accesses rewrites an atomic operation on...

PT-2026-98721

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the bpf sys bpf and bpf sys close functions are not correctly marked as sleepable. The bpf sys bpf function executes the bpf2 syscall body, whi...

PT-2026-98722

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the sched process wait tracepoint does not correctly mark its first argument as nullable. When do wait passes wo-wo pid ...

PT-2026-98724

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where tail calls made directly from callback frames are not properly handled. When a tail call occurs from a non-zero frame, t...

PT-2026-98726

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the btf var show function. This occurs because the function calls btf type id resolve unconditionally, which attempts to dereference btf-resolved ids...

PT-2026-98727

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference occurs in the BPF subsystem when processing a void BTF type. The function btf modifier show resolves a modifier and unconditionally calls btf type opst-show...

PT-2026-98747

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the verifier fails to correctly propagate precision for register R1 during the second iteration of a bpf loop call...

PT-2026-98748

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug exists in the precision backtracking mechanism for BPF LD | BPF IND,ABS instructions. These instructions are modeled as two branches: a fallthrough and an implicit exit from the...

PT-2026-98794

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the clean func state function in states.c can incorrectly downgrade a scalar zero spill to STACK ZERO. This occurs when ...

PT-2026-98796

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF verifier where it can incorrectly infer that a pointer is non-null. This occurs during the processing of comparisons like rA == rB within the check cond jmp op...

PT-2026-98811

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem regarding per-CPU map updates for array, hash, and cgroup storage maps when BPF F CPU or BPF F ALL CPUS are not used. The syst...

PT-2026-98812

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Linux kernel where bpf map check op flags incorrectly validates the target CPU ID stored in the upper 32 bits of map operation flags when BPF F CPU is used. The...

PT-2026-98813

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where a register invariants violation occurs during speculative pointer arithmetic. When processing instructions in adjust ptr...

PT-2026-98831

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF Berkeley Packet Filter subsystem where the bpf refcount field is not marked as unique. This oversight relates to how reference counts are tracked for BPF...

CVE-2026-98048

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...