PT-2026-72611

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts sz argument. The verifier checks only the memory range described by opts sz, but the wrappers...

PT-2026-72774

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF LSM CGROUP programs at load time The cgroup shim runs under rcu read lock dont migrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts...

PT-2026-72300

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check mem access When the BPF verifier processes a context load of an LSM hook return value, it calls mark reg s32 range to narrow the register to the hook's valid range...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-72590

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print bpf insn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF PSEUDO MAP FD and BPF PSEUDO MAP VALUE...

CVE-2026-12364

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

EUVD-2026-58750

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

CVE-2026-12364 Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, cosign-fips, gh, cosign...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, image-factory, falcoctl-fips, goreleaser, slsa-verifier, trivy-operator-fips, sigstore-scaffolding, kubescape, trivy, kyverno-notation-aws, sigstore-scaffolding-fips, chainctl, policy-controller-fips, spire-server, falcoctl, skaffold-fips, ko-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, sigstore-scaffolding, kubescape, trivy, melange, sigstore-scaffolding-fips, policy-controller-fips, chainctl, spire-server, falcoctl, cosign-fips, flux-source-controller-fips, spire-server-fips, flux-source-controller, tekton-chains-fips...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, goreleaser, kubescape, melange, policy-controller-fips, chainctl, spire-server, falcoctl, ko-fips, spire-server-fips, flux-source-controller, tekton-chains-fips, tkn-fips, vexctl, ko, neuvector-sigstore-interface, apko, tkn, zarf,...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: cosign, slsa-verifier, gh...

GO-2023-2334 vulnerabilities

Vulnerabilities for packages: cosign, tekton-chains, oauth2-proxy, kubescape, sops, fulcio, argo-workflows, rekor, flux-kustomize-controller, vexctl, flux-source-controller, aactl, cloudflared, kots, slsa-verifier, spire-server, dex, gitsign, terragrunt, tkn...

GO-2026-5853 vulnerabilities

Vulnerabilities for packages: skopeo, kyverno, buildah, podman, tekton-chains, flux-source-controller, undock, kots, witness, slsa-verifier, kubescape, kyverno-notation-aws, zarf, ratify, aactl, gitsign, falcoctl...

GO-2026-5694 vulnerabilities

Vulnerabilities for packages: teleport, kyverno, zot, trivy, slsa-verifier, trivy-operator, kubescape, kyverno-notation-aws, policy-controller, ratify, crossplane, aactl...

GO-2026-4529 vulnerabilities

Vulnerabilities for packages: vexctl, teleport, kyverno, tekton-chains, zot, trivy, slsa-verifier, trivy-operator, kyverno-notation-aws, ko, skaffold, ratify, crossplane, aactl, tkn...

GO-2026-5778 vulnerabilities

Vulnerabilities for packages: kyverno, tekton-chains, kubescape, policy-controller, trivy-operator, ko, crossplane, aactl, neuvector-sigstore-interface, slsa-verifier, spire-server, zarf, goreleaser, gitsign, falcoctl, teleport, kyverno-notation-aws, tkn, ratify, tflint...

GO-2023-2181 vulnerabilities

Vulnerabilities for packages: cosign, melange, tekton-chains, flux-source-controller, slsa-verifier, spire-server, kubescape, policy-controller, apko, ko, skaffold, aactl, tkn...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: crossplane-provider-azure-authorization, tekton-chains, kubescape, crossplane-provider-aws-cloudfront, cert-manager, crossplane-provider-aws-sqs, fulcio, glab, ksops, gatus, external-dns, flux-kustomize-controller, zot, argo-cd, buildkitd, ko,...