CVE-2026-90312

CVE-2026-90312 affects the Linux kernel BPF verifier . In check_atomic_load(), the function calls check_load_mem() before atomic_ptr_type_ok(). When a load-acquire fetches into its own source register (dst_reg == src_reg), check_load_mem() overwrites the source register's type, causing atomic_ptr...

CVE-2026-90313 bpf, cgroup: Fix invalid storage access after __cgroup_bpf_attach failed

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix invalid storage access after cgroupbpfattach failed A potential invalid storage access issue can occur after replacing a cgroup bpf prog. This occurs in the following scenario: 1. prog1 with storage is attached t...

CVE-2026-90300 bpf: Clear buf on error in __bpf_get_task_stack

In the Linux kernel, the following vulnerability has been resolved: bpf: Clear buf on error in bpfgettaskstack Both bpfgettaskstack and bpfgettaskstacksleepable helpers that use bpfgettaskstack have buf defined as ARGPTRTOUNINITMEM argument and we should initialize the buf on every return path...

CVE-2026-90299

CVE-2026-90299 affects the Linux kernel BPF subsystem. When CONFIG_FUNCTION_ERROR_INJECTION is disabled, the BPF verifier fails to distinguish whether an attachment target symbol is a kernel function or a BPF program , allowing a sleepable tracing program to attach to a non-kernel BPF program who...

EUVD-2026-81892

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

CVE-2026-90299 bpf: Fix sleepable check for tracing/lsm prog

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

CVE-2026-90299 bpf: Fix sleepable check for tracing/lsm prog

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix sleepable check for tracing/lsm prog When CONFIGFUNCTIONERRORINJECTION is disabled, a sleepable tracing prog is allowed to attach to 'x64'-alike prefix symbols. It is because the verifier does not verify whether the symb...

CVE-2026-90269

CVE-2026-90269 affects the Linux kernel BPF subsystem. The verifier fails to rewrite BPF_LOAD_ACQ (load-acquire) into a BPF_PROBE_MEM load, unlike a regular BPF_LDX . As a result, the JIT emits a plain load with no exception-table entry, so a page fault on that load panics the kernel instead of b...

CVE-2026-90269 bpf: Reject load-acquire from pointers requiring fault protection

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

EUVD-2026-81862

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

CVE-2026-90269 bpf: Reject load-acquire from pointers requiring fault protection

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject load-acquire from pointers requiring fault protection A BPFLOADACQ is not rewritten to a BPFPROBEMEM load by the verifier, unlike a regular BPFLDX, so the JIT emits a plain load with no exception table entry and a fau...

EUVD-2026-81843

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

CVE-2026-90250

CVE-2026-90250 is a null pointer dereference vulnerability in the Linux kernel's BPF/cgroup subsystem . The issue occurs when a BPF program using BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE replaces an empty prog via link_update. The root cause is that __cgroup_bpf_replace fails to allocate and assign the...

CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog

In the Linux kernel, the following vulnerability has been resolved: bpf, cgroup: Fix storage null-ptr-deref after replacing prog Syzkaller reported a storage null-ptr-deref issue after replacing prog. This occurs in the following scenario: 1. prog A, an empty prog, is attached to a cgrp. 2. prog ...

EUVD-2026-81840

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix mmaplock leak in irqwork path stackmapgetbuildidoffset introduced a per-CPU irqwork to defer mmapreadunlock from NMI context, and bpffindvma later reused the same mmapunlockwork. Both callers only check whether the work ...

CVE-2026-90247

CVE-2026-90247 affects the Linux kernel BPF subsystem . The vulnerability resides in the per-CPU mmap_unlock_work irq_work slot shared by stack_map_get_build_id_offset() and bpf_find_vma(). Because both callers only check whether the work is busy before taking mmap_lock, a nested caller can reuse...

EUVD-2026-81810

In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEMRCU or PTRUNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACKITER slots...

CVE-2026-90217 bpf: Compare iterator types during state pruning

In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEMRCU or PTRUNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACKITER slots...