CVE-2026-72402

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs printbpfinsn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPFPSEUDOMAPFD and BPFPSEUDOMAPVALUE...

CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

UBUNTU-CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

CVE-2026-72111

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

CVE-2026-68462

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

UBUNTU-CVE-2026-68462

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-68462

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-74338

CVE-2026-74338 concerns the Linux kernel: a BPF_LSM_CGROUP sleepable program could be loaded in a context where sleeping is disallowed, triggering a BUG from sleeping in an invalid context during file_open. The fix adds verifier support to reject loading sleepable BPF_LSM_CGROUP programs destined...

EUVD-2026-59485

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...

CVE-2026-74338 bpf: Reject sleepable BPF_LSM_CGROUP programs at load time

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPFLSMCGROUP programs at load time The cgroup shim runs under rcureadlockdontmigrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to lo...

EUVD-2026-59325

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead stack slots in 4-byte halves. When the high half of a STACKSPILL slot is dead and the low half remains live, cleanup converts the live low...

CVE-2026-72426 bpf: Preserve pointer spill metadata during half-slot cleanup

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead stack slots in 4-byte halves. When the high half of a STACKSPILL slot is dead and the low half remains live, cleanup converts the live low...

EUVD-2026-59322

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72423

The CVE-2026-72423 vulnerability affects the Linux kernel’s BPF conntrack error reporting: wrappers for conntrack kfuncs may write to opts->error outside the verifier-checked range, for certain sizes. The issue occurs when using an opts pointer with an accompanying opts__sz argument; the verif...

CVE-2026-72423 bpf: Guard conntrack opts error writes

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72423 bpf: Guard conntrack opts error writes

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

EUVD-2026-59300

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps directly to errfreeenv. The existing vfreeenv-insnauxdata sits before the...

CVE-2026-72401 bpf: Fix insn_aux_data leak on verifier err_free_env path

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps directly to errfreeenv. The existing vfreeenv-insnauxdata sits before the...

CVE-2026-72401 bpf: Fix insn_aux_data leak on verifier err_free_env path

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insnauxdata leak on verifier errfreeenv path When bpfcheck allocates env-insnauxdata successfully but later fails to allocate env-succ, it jumps directly to errfreeenv. The existing vfreeenv-insnauxdata sits before the...

CVE-2026-72402

CVE-2026-72402 : In the Linux kernel, the bpf verifier logs could reveal kernel pointer values via ldimm64 immediates for pointer-bearing pseudo sources. The function print_bpf_insn() previously masked only BPF_PSEUDO_MAP_FD and BPF_PSEUDO_MAP_VALUE; the risk extended to BPF_PSEUDO_MAP_IDX, BPF_P...