SUSE CVE-2026-93174

In the Linux kernel, the following vulnerability has been resolved: bpf: Copy per-CPU map value padding in copymapvaluelong In kernel, per-CPU map elements are stored with roundupmap-valuesize, 8 bytes. On UAPI lookup paths, it copies the rounded size for each CPU into a temporary buffer. However...

SUSE CVE-2026-90146

In the Linux kernel, the following vulnerability has been resolved: bpf, xdp: move offload check into devxdpinstall bpfxdplinkupdate calls devxdpinstall directly and skips devxdpattach, so the checks in devxdpattach do not run. A user can make an XDP link with a normal program and then swap in an...

SUSE CVE-2026-90177

In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTRTOARENA. A second path can therefore reach the same instruction with an ordinary...

SUSE CVE-2026-90195

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

SUSE CVE-2026-90312

In the Linux kernel, the following vulnerability has been resolved: bpf: Check load-acquire src ptr type before the load checkatomicload calls checkloadmem before atomicptrtypeok. For a load-acquire that fetches into its own source register dstreg == srcreg, checkloadmem overwrites srcreg's type...

SUSE CVE-2026-90313

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

SUSE CVE-2026-90359

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject 8 byte return values on return-reading trampoline paths btfdistillfuncproto builds the function model used for the fentry/fexit/fmodret/fsession trampolines and structops. It has accepted a 16-byte int128 return value...

OESA-2026-3990 libpcap security update

This is the official web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. Security Fixes: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and...

OESA-2026-3991 libpcap security update

This is the official web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. Security Fixes: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and...

OESA-2026-3989 libpcap security update

This is the official web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. Security Fixes: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and...

OESA-2026-3988 libpcap security update

This is the official web site of tcpdump, a powerful command-line packet analyzer; and libpcap, a portable C/C++ library for network traffic capture. Security Fixes: In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and...

SUSE CVE-2026-89906

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

SUSE CVE-2026-93112

In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpfcpumaskpopulate bpfcpumaskpopulate writes to its destination with bitmapcopy, but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returne...

SUSE CVE-2026-93127

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

MGASA-2026-0416 Updated libpcap packages fix security vulnerabilities

OOBR and OOBW in libpcap before 1.10.7. CVE-2026-0799 abort in libpcap before 1.10.7 on an invalid BPF opcode. CVE-2026-31911 OOBR in libpcap before 1.10.7. CVE-2026-31912 Division by zero in libpcap before 1.10.7. CVE-2026-6244 Infinte loop in libpcap before 1.10.7. CVE-2026-6554 rpcapd memory...

Updated libpcap packages fix security vulnerabilities

OOBR and OOBW in libpcap before 1.10.7. CVE-2026-0799 abort in libpcap before 1.10.7 on an invalid BPF opcode. CVE-2026-31911 OOBR in libpcap before 1.10.7. CVE-2026-31912 Division by zero in libpcap before 1.10.7. CVE-2026-6244 Infinte loop in libpcap before 1.10.7. CVE-2026-6554 rpcapd memory...

SUSE CVE-2026-90143

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcmparsefuncstrparser calls bpfprogrunpinoncpu which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can...

SUSE CVE-2026-90210

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpftrampolinemultiattachfree on update failure When bpftrampolineupdate fails before modifyfentrymulti/ unregisterfentrymulti is called, curimage is unchanged curimage == oldimage and ftrace still calls into it...

SUSE CVE-2026-90211

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

SUSE CVE-2026-90217

In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEMRCU or PTRUNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACKITER slots...