CVE-2026-93125 bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

CVE-2026-93112 bpf: Require a BPF cpumask for bpf_cpumask_populate()

In the Linux kernel, the following vulnerability has been resolved: bpf: Require a BPF cpumask for bpfcpumaskpopulate bpfcpumaskpopulate writes to its destination with bitmapcopy, but the destination is typed as struct cpumask . That allows the verifier to accept borrowed cpumask pointers returne...

CVE-2026-93112

CVE-2026-93112 affects the Linux kernel BPF subsystem. The vulnerability is in bpf_cpumask_populate() , whose destination parameter is typed as struct cpumask * instead of struct bpf_cpumask *. This type mismatch allows the BPF verifier to accept borrowed, read-only cpumask pointers (e.g., from s...

EUVD-2026-82219

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracingmulti trampolines as ftrace managed Since tracingmulti link does not set ftracemanaged, it would fail to release the tracingmulti link when attaching tracingmulti link and then attaching fentry link. 3.714215...

CVE-2026-93111

This vulnerability affects the Linux kernel BPF subsystem, specifically the tracing_multi trampoline mechanism. The root cause is that the tracing_multi link does not set the ftrace_managed flag, which causes the link to fail release when a tracing_multi link is attached followed by an fentry lin...

CVE-2026-93111 bpf: Mark tracing_multi trampolines as ftrace managed

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracingmulti trampolines as ftrace managed Since tracingmulti link does not set ftracemanaged, it would fail to release the tracingmulti link when attaching tracingmulti link and then attaching fentry link. 3.714215...

CVE-2026-93044

CVE-2026-93044 affects the Linux kernel BPF subsystem. The BPF interpreter does not support arena-related instructions (ST/LDX/STX). When a BPF program using an arena map falls back to the interpreter (via core.c::__bpf_prog_select_runtime()), execution hits a BUG_ON() at kernel/bpf/core.c:2349, ...

EUVD-2026-82154

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93044 bpf: Disallow interpreter fallback for arena-related insns

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93044 bpf: Disallow interpreter fallback for arena-related insns

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

CVE-2026-93043

CVE-2026-93043 affects the Linux kernel BPF subsystem . The BPF interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X instruction (gotox), which is used when an insn_array map is referenced by a BPF program. At runtime, this causes a BUG_ON() crash in ___bpf_prog_run() (kernel/bpf/core.c:2349),...

EUVD-2026-82153

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-93043 bpf: Disallow interpreter fallback for gotox insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-93043 bpf: Disallow interpreter fallback for gotox insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-92520

CVE-2026-92520 affects the Linux kernel 's BPF subsystem, specifically the queue and stack pop/peek helpers . The verifier expects these helpers to initialize their output buffer, and the empty-map error path does clear it. However, a failed lock acquisition returns -EBUSY without writing the buf...

CVE-2026-92520 bpf: Zero queue and stack outputs on lock failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

EUVD-2026-82141

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92520 bpf: Zero queue and stack outputs on lock failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92519 riscv, bpf: Fix memory leak in bpf_jit_free

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If JIT...

EUVD-2026-82139

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...