EUVD-2026-86914

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

CVE-2026-98084

The Linux kernel contains a vulnerability in the BPF verifier related to bpf_loop(). When processing callbacks, the verifier is intended to mark register R1 (which tracks loop iterations) as precise to satisfy callback_depth

CVE-2026-98007

The Linux kernel contains a vulnerability in the bpf_loop() helper function where the nr_loops argument is incorrectly declared as ARG_ANYTHING. This allows privileged programs to pass pointer values instead of scalars. Because the verifier marks these registers as precise, passing a pointer trig...

CVE-2026-98007

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

EUVD-2026-86660

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...