CVE-2026-64353

CVE-2026-64353 affects the Linux kernel BPF subsystem. The issue arises when an ARRAY_OF_MAPS uses an inner map template created with BPF_F_INNER_MAP; a concrete inner array with a different max_entries can replace the template, causing the verifier to mis-handle nullness of lookup results. The k...

CVE-2026-64353

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAYOFMAPS can use an array created with BPFFINNERMAP as its inner map template. A concrete inner array with a different maxentries value can then replace the template. After a...

PT-2026-64729

In the Linux kernel, the following vulnerability has been resolved: bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those allocations as programs are loaded and freed. When fresh code is...

Linux Distros Unpatched Vulnerability : CVE-2026-64508

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Support for hardening against JIT spraying The BPF JIT allocator packs many small programs into larger executable allocations and reuses space within those...

Linux Distros Unpatched Vulnerability : CVE-2026-64507

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - x86/bugs: Enable IBPB flush on BPF JIT allocation Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flus...

CVE-2026-63864

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The visittailcallinsn function, which is part of the BPF program validation process, failed to check and propagate error return values. This oversight could lead to an unhandled error condition within the kernel,...

SUSE CVE-2026-63926

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpfmsgpushdata When bpfmsgpushdata inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is...

CVE-2026-64192

A flaw was found in the Linux kernel. When the BPF Berkeley Packet Filter Linux Security Module LSM is compiled into the kernel but not explicitly enabled at boot, a privileged user can create and update a BPF inode storage map. This improper initialization leads to an incorrect memory offset...

CVE-2026-64192

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

EUVD-2026-46012

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPFMAPTYPEINODESTORAGE creation if BPF LSM is uninitialized When CONFIGBPFLSM=y is set, BPF inode storage maps BPFMAPTYPEINODESTORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly enabled at...

PT-2026-61645

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject BPF MAP TYPE INODE STORAGE creation if BPF LSM is uninitialized When CONFIG BPF LSM=y is set, BPF inode storage maps BPF MAP TYPE INODE STORAGE are compiled into the kernel. However, if the BPF LSM is not explicitly...

Linux Distros Unpatched Vulnerability : CVE-2026-64036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu...

CVE-2026-64025

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...

CVE-2026-63926 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpfmsgpushdata When bpfmsgpushdata inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is...

CVE-2026-63864

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

CVE-2026-63864 bpf: Propagate error from visit_tailcall_insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Propagate error from visittailcallinsn Commit e40f5a6bf88a "bpf: correct stack liveness for tail calls" added visittailcallinsn but did not check its return value...

PT-2026-61182

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Certain sleepable LSM Linux Security Module programs cannot be used with the bpf lsm task to inode function because it is called under rcu read lock, and the bpf lsm inet conn establishe...

PT-2026-61243

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf msg push data function within the sockmap component of the BPF Berkeley Packet Filter subsystem. When data is inserted into the middle of a scatterlist entry,...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: A narrower access to the pointer ctx fields was rejected. The following BPF program, simplified from a syzkaller repro, causes a kernel warning: c r0 = u8 r1 + 169; exit; Here, the pointer field sk is located at offset 168 i...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb-transportheader is set in bpfskbcheckmtu. The bpfskbcheckmtu helper needs to use skb-transportheader when the BPFMTUCHKSEGS flag is used: bpfskbcheckmtuskb, ifindex, &mtulen, 0, BPFMTUCHKSEGS. The transportheader i...