CVE-2026-89581

A flaw was found in the Linux kernel's handling of Berkeley Packet Filter BPF programs on x86 architecture. An issue with how per-CPU addresses are resolved into extended registers can lead to incorrect memory access. A local attacker could exploit this by running a specially crafted BPF program...

DEBIAN-CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

DEBIAN-CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

DEBIAN-CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

AZL-100767 CVE-2026-89580 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

AZL-100580 CVE-2026-89564 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

CVE-2026-89564

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89564

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

UBUNTU-CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

CVE-2026-89579

In the Linux kernel, the following vulnerability has been resolved: bpf: Harden bloom filter sizing and indexing on 32-bit kernels bloommapalloc has two 32-bit-specific problems when the computed bitmap reaches the U32MAX fallback case. First, BITSTOBYTESU32MAX is evaluated with 32-bit arithmetic...

UBUNTU-CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

UBUNTU-CVE-2026-89581

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

CVE-2026-89580

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpfgetstack getperfcallchain returns a per-CPU perfcallchainentry buffer and releases its recursion slot via putcallchainentry before returning, so nothing keeps the entry reserved while bpfgetstack...

UBUNTU-CVE-2026-89564

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

CVE-2026-89581 bpf, x86: Fix per-CPU address resolution into an extended register

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...

EUVD-2026-76493

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix per-CPU address resolution into an extended register The destination of the per-CPU address MOV is encoded in ModRM.reg, which is extended by REX.R, but the REX prefix is built with add1mod, which sets REX.B. REX.B...