EUVD-2026-82255

In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Replace ly instruction with llgf cpunr is a 32 bit value and BPFREG0 is a 64 bit register, when ly loads the cpunr into BPFREG0 it does not zero the upper bits, but llgf does...

EUVD-2026-82252

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject writes through untrusted BTF pointers checkptrtobtfaccess lets program-type btfstructaccess callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy fo...

CVE-2026-93144

CVE-2026-93144 affects the Linux kernel BPF subsystem . The root cause is in check_ptr_to_btf_access(), which allows program-type btf_struct_access callbacks to validate writes before the default BTF access path rejects non-read accesses, thereby bypassing the read-only policy for untrusted BTF p...

EUVD-2026-82243

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject programs with inlined helpers if JIT is not available When an architecture such as LoongArch, ARM64, and RISC-V implements bpfjitinlineshelpercall, the verifier skips rewriting the helper call offset insn-imm in...

EUVD-2026-82235

In the Linux kernel, the following vulnerability has been resolved: bpf: Drop scalar id on sign-extending narrowing stack fills When a spilled scalar is filled back with a sign-extending narrowing load BPFMEMSX, checkstackreadfixedoff copies the spilled register including its scalar id, but...

EUVD-2026-82233

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject rdonly/rdwrbufsize kfunc arguments that exceed u32 max checkkfuncargs detects a kfunc argument named rdonlybufsize or rdwrbufsize and stores reg-varoff.value into meta-r0size, a u64, and does not bound it...

CVE-2026-93125

CVE-2026-93125 affects the Linux kernel BPF verifier . The root cause is in check_kfunc_args(), which stores a reg->var_off.value into meta->r0_size (a u64 ) without bounding it. When check_kfunc_call() later copies that value into regs[BPF_REG_0].mem_size (a u32 ), a constant whose upper 3...

CVE-2026-93112

CVE-2026-93112 affects the Linux kernel BPF subsystem , specifically the bpf_cpumask_populate() kfunc. The root cause is a type mismatch : the function's destination parameter is typed as struct cpumask * rather than struct bpf_cpumask *, allowing the BPF verifier to accept borrowed cpumask point...

CVE-2026-93111

CVE-2026-93111 affects the Linux kernel BPF subsystem, specifically the tracing_multi trampoline mechanism. The root cause is that the tracing_multi link fails to set ftrace_managed, which causes the kernel to fail when releasing a tracing_multi link if an fentry link is subsequently attached. Th...

EUVD-2026-82219

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark tracingmulti trampolines as ftrace managed Since tracingmulti link does not set ftracemanaged, it would fail to release the tracingmulti link when attaching tracingmulti link and then attaching fentry link. 3.714215...

CVE-2026-93044

CVE-2026-93044 affects the Linux kernel BPF subsystem. The BPF interpreter does not support arena-related instructions (ST/LDX/STX). When a BPF program using an arena map falls back to the interpreter (via core.c::__bpf_prog_select_runtime()), execution hits a BUG_ON() at kernel/bpf/core.c:2349, ...

EUVD-2026-82154

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

EUVD-2026-82153

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for gotox insn The interpreter does not recognize the BPFJMP|BPFJA|BPFX insn, which is used for insnarray map. Thereafter, it would hit the BUGON in bpfprogrun at run time. 2.563726 BPF...

CVE-2026-93043

CVE-2026-93043 affects the Linux kernel BPF subsystem . The BPF interpreter does not recognize the BPF_JMP|BPF_JA|BPF_X instruction (gotox), which is used when an insn_array map is referenced by a BPF program. At runtime, this causes a BUG_ON() crash in ___bpf_prog_run() (kernel/bpf/core.c:2349),...

CVE-2026-92520

CVE-2026-92520 affects the Linux kernel 's BPF subsystem, specifically the queue and stack pop/peek helpers . The verifier expects these helpers to initialize their output buffer, and the empty-map error path does clear it. However, a failed lock acquisition returns -EBUSY without writing the buf...

EUVD-2026-82141

In the Linux kernel, the following vulnerability has been resolved: bpf: Zero queue and stack outputs on lock failure Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a...

CVE-2026-92518

CVE-2026-92518 affects the Linux kernel on the RISC-V architecture in the BPF subsystem. When CONFIG_CFI_CLANG is enabled, prog->bpf_func already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes the kernel to jump over an extra 4 bytes, skipping th...

EUVD-2026-82139

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix kernel stack corruption in tailcall with CFI When CONFIGCFICLANG is enabled, prog-bpffunc already skips the kcfi instruction during setup. Including it again in the tailcall jump offset causes it to jump over an...

CVE-2026-92517

CVE-2026-92517 affects the Linux kernel on RISC-V , specifically in the BPF arena load_acquire path. The root cause is in emit_atomic_ld_st(), which returns a non-zero value (1) to signal that build_body() should skip a zero-extension step. Because the caller uses ret = ret ?: add_exception_handl...

EUVD-2026-82138

In the Linux kernel, the following vulnerability has been resolved: bpf, riscv: Fix extable handling for arena loadacquire emitatomicldst returns 1 to have buildbody skip the zext after a sub-word loadacquire. The caller does "ret = ret ?: addexceptionhandler...", which skips addexceptionhandler ...