CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

EUVD-2026-82255

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93147 s390/bpf: Replace ly instruction with llgf

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

CVE-2026-93144 bpf: Reject writes through untrusted BTF pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

EUVD-2026-82252

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-93144

CVE-2026-93144 affects the Linux kernel BPF subsystem, specifically the check_ptr_to_btf_access() path. The root cause is that program-type btf_struct_access callbacks can validate writes before the default BTF access path rejects non-read accesses, bypassing the read-only policy enforced for unt...

CVE-2026-93144 bpf: Reject writes through untrusted BTF pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-93137 bpf: Fix use-after-free on mm_struct in bpf_find_vma()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free on mmstruct in bpffindvma bpffindvma reads task-mm and calls mmapreadtrylockmm without holding a reference on the mm. On a foreign task, a concurrent exitmm can free the mmstruct between the lockless read...

CVE-2026-93135 bpf: Reject programs with inlined helpers if JIT is not available

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

EUVD-2026-82243

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

CVE-2026-93135 bpf: Reject programs with inlined helpers if JIT is not available

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

EUVD-2026-82235

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-93127 bpf: Drop scalar id on sign-extending narrowing stack fills

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-93127 bpf: Drop scalar id on sign-extending narrowing stack fills

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

CVE-2026-93125 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

CVE-2026-93125

CVE-2026-93125 is a Linux kernel BPF verifier bug in the handling of kfunc arguments named rdonly_buf_size or rdwr_buf_size. The function check_kfunc_args() stores the argument value into a u64 field (meta->r0_size) without bounding it. check_kfunc_call() then copies that value into regs[BPF_R...

CVE-2026-93125 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

EUVD-2026-82233

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

CVE-2026-93112 bpf: Require a BPF cpumask for bpf_cpumask_populate()

In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpfcpumaskpopulate bpfcpumaskpopulate writes to its destination with bitmapcopy, but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returne...

CVE-2026-93112

CVE-2026-93112 affects the Linux kernel BPF subsystem. The vulnerability is in bpf_cpumask_populate() , whose destination parameter is typed as struct cpumask * instead of struct bpf_cpumask *. This type mismatch allows the BPF verifier to accept borrowed, read-only cpumask pointers (e.g., from s...