CVE-2017-16995

CVE-2017-16995 CVE ID: CVE-2017-16995 Publish date: 2017-12-27T17:08:17.670 Base score CVSS 3.0/3.1: 7.8 Description: The checkaluop function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service memory corruption or possibly have unspecified oth...

CVE-2021-29155

This is the Proof Of Concept code for CVE-2021-29155. The range tracking system for pointer arithmetic in the speculative domain was insufficient. It was possible to extract kernel data via a sidechannel. This is a proof of concept you can read up to 0x5fff bytes out of bounds from the last eleme...

CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: One Byte in the BPF Verifier to Container Escape I found a soundness bug in the Linux BPF verifier - a + 1 in a pushstack call that causes the verifier to skip an ALU instruction on a forked path. For BPFOR, this means the verifier tracks dst = 0 while the CPU computes 0 | K = K. ...

CVE-2017-16995

CVE-2017-16995 A record of my own tinkering with the CVE-2017-16995 vulnerability and related analysis Hopefully I can find one myself, lol Overview This vulnerability is an LPE caused by an error in the verifier's branch judgment during BPF virtual execution In essence, it is an integer extensio...

CVE-2020-8835

CVE-2020-8835 In the Linux kernel 5.5.0 and newer, the bpf verifier kernel/bpf/verifier.c does not properly restrict the register bounds for 32-bit operations, leading to out-of-bounds reads and writes in kernel memory. This vulnerability also affects the Linux 5.4 stable series, starting with...

CVE-2026-98869

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local attacker could achieve privilege escalation by loading a specially crafted BPF program into the kernel. The vulnerability occurs because the verifier fails to properly track register states across execution paths...

SUSE CVE-2026-98869

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zextdst based on static register liveness analysis As reported in the thread 1, the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on...

CVE-2026-98869

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zextdst based on static register liveness analysis As reported in the thread 1, the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on...

CVE-2026-98869

In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zextdst based on static register liveness analysis As reported in the thread 1, the verifier's 32-bit operations zero extension logic is broken. This logic is responsible for correct semantics of 32-bit operations on...

CVE-2026-98085

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local user with permissions to load BPF programs could exploit this vulnerability to cause a Denial of Service DoS via a kernel crash or potentially bypass verifier safety checks. This issue occurs because the verifier...

Linux Kernel Security Vulnerabilities

The Linux kernel version 6.18 contains security vulnerabilities. These vulnerabilities stem from a logical flaw in the 32-bit operation zero extension of the BPF verifier, which may allow arbitrary values to be injected into the upper half of the register...

CVE-2026-98599

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. A local attacker can exploit this flaw to cause kernel memory corruption and potentially achieve privilege escalation or a denial of service system crash. This vulnerability occurs because the verifier fails to reject...

CVE-2026-98589

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. When packet pointers are passed into subprograms that mutate packet data, the verifier incorrectly assumes the underlying memory remains valid across calls, failing to account for operations that invalidate or relocate...

CLSA-2024-1720468480 kernel: Fix of 101 CVEs

kvm: initialize all of the kvmdebugregs structure before sending it to userspace CVE-2023-1513 - wifi: mac80211: fix MBSSID parsing use-after-free CVE-2022-42719 - mac80211: always allocate struct ieee80211elems CVE-2022-42719 - netfilter: nftables: initialize registers in nftdochain...

Linux Kernel Security Vulnerabilities

Versions of the Linux kernel prior to 7.2.9 have a security vulnerability. This vulnerability arises from the BPF verifier failing to reject the transfer of the PTRTOPACKET pointer to procedures that may modify data packets, potentially causing the data packet memory area to become invalid...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf: synclinked regs must preserve subregdef Range propagation must not affect subregdef marks. Otherwise, the following example is rewritten incorrectly by the verifier when the BPFFTESTRNDHI32 flag is set: 0: call bpfktimegetns...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed the overloading of the meaning of MEMUNINIT Lonial reported an issue with the BPF verifier, where the checkmemsizereg function contains the following code: c if !tnumisconstreg-varoff / For unprivileged variable...

CVE-2026-90312

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF. This vulnerability arises from an issue in how the BPF verifier processes certain memory load operations, specifically when a load-acquire instruction fetches into its own source register. This can lead to a type confusion, where...

CVE-2026-90217

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF verifier. The verifier, responsible for ensuring the safety of BPF programs, incorrectly compared iterator types during state pruning. This discrepancy between MEMRCU and PTRUNTRUSTED states could allow the verifier to prune an...

CVE-2026-90177

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. This vulnerability arises because the atomic Read-Modify-Write RMW verification process does not consistently check pointer types across all execution paths. Specifically, it only records the instruction pointer type when...