5 matches found
CVE-2026-98643
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...
CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...
EUVD-2026-103557
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...
CVE-2026-98643
The Linux kernel is vulnerable to an out-of-bounds read within the bpf subsystem. Specifically, a sockops program reading skops->rtt_min fails to verify the socket type. On the tcp_conn_request() path, sock_ops->sk is a request_sock (non-full), but the context rewrite incorrectly casts it t...
CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...