CVE-2026-98134

In the Linux kernel, the following vulnerability has been resolved: b...

EUVD-2026-86965

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98134

The Linux kernel BPF verifier contains a logic error in check_cond_jmp_op() where it incorrectly infers that a pointer is non-null. This occurs during comparisons (e.g., rA == rB) when one pointer type lacks the PTR_MAYBE_NULL flag but can still be NULL at runtime, such as types like PTR_TO_MEM. ...

CVE-2026-98042

The Linux kernel contains a vulnerability in the bpf subsystem where check_cond_jmp_op() incorrectly handles snapshots of compared registers. Specifically, collect_linked_regs() might call clear_scalar_id() on the compared register if it exceeds the LINKED_REGS_MAX limit. Because the register is ...

CVE-2026-98040

The Linux kernel contains a vulnerability in the BPF verifier where check_cond_jmp_op() incorrectly handles register-form NULL checks . When a nullable pointer rA is compared against a scalar rB known to be zero, the verifier lifts PTR_MAYBE_NULL from rA but fails to mark rB as precise. This allo...

EUVD-2026-86693

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

CVE-2026-98134

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98042

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collectlinkedregs checkcondjmpop copies the compared registers into env-false,truereg1,2 before collectlinkedregs runs and copies those snapshots back into both branch states afterwards...