CVE-2026-31413-BPF-Container-Escape

CVE-2026-31413: One Byte in the BPF Verifier to Container Escape I found a soundness bug in the Linux BPF verifier - a + 1 in a pushstack call that causes the verifier to skip an ALU instruction on a forked path. For BPFOR, this means the verifier tracks dst = 0 while the CPU computes 0 | K = K. ...

Linux Distros Unpatched Vulnerability : CVE-2026-80865

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Add missing accessok call to copyusersyms As reported by sashiko we use getuser without prior accessok call on the user space pointer. Adding the missing...

Linux Distros Unpatched Vulnerability : CVE-2026-74720

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer stat...

Linux Distros Unpatched Vulnerability : CVE-2025-38528

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt = %p%;...

The vulnerability of the BPF subsystem in Linux operating systems allows attackers to gain unauthorized access to protected information.

The vulnerability of the BPF subsystem in Linux operating systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Linux Kernel 4.4 (Ubuntu 16.04) - BPF Local Privilege Escalation (Metasploit)

Linux kernel versions 4.4 and above where CONFIGBPFSYSCALL and kernel.unprivilegedbpfdisabled sysctl is not set to 1 allow for BPF to be abused for privilege escalation. Ubuntu 16.04 has all of these conditions met. This module requires Metasploit: http://metasploit.com/download Current source:...