CVE-2026-90317

CVE-2026-90317 affects the Linux kernel BPF subsystem. In a sleepable BPF program , a spin lock may be the only RCU protection for a kptr. When the final bpf_spin_unlock() ends that protection, the verifier incorrectly leaves the pointer valid, allowing another CPU to free the object before it is...

EUVD-2026-81978

In the Linux kernel, the following vulnerability has been resolved: bpf: Invalidate RCU pointers after final spin unlock In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpfspinunlock ends that protection, but the verifier leaves the pointer valid...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - BPF: The rcureadlockTraceheld function in bpfmaplookuppercpuelem needs to be checked. The bpfmaplookuppercpuelem helper function is also available for sleepable BPF programs. When BPF JIT is disabled or on a 32-bit host,...

SUSE CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

AZL-93611 CVE-2026-64352 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

UBUNTU-CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

CVE-2026-64352 affects the Linux kernel BPF subsystem , specifically the LPM (Longest Prefix Match) trie implementation in kernel/bpf/lpm_trie.c. The root cause is incorrect RCU lock annotations : trie_lookup_elem() used rcu_read_lock_bh_held() which does not accept the Tasks Trace RCU held by sl...

PT-2026-64573

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.1.0 Description An issue exists in the Linux kernel where sleepable BPF programs cannot properly access Longest Prefix Match LPM maps. The function trie lookup elem uses an annotation that only validates classi...

Linux Distros Unpatched Vulnerability : CVE-2026-64352

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Support deferring bpflink deallocation to after RCU grace period For some program types, the “bpflink” is passed as a “context” that can be used by those BPF programs to retrieve additional information. For example, for...

kernel: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld in bpfmaplookuppercpuelem bpfmaplookuppercpuelem helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpfmaplookuppercpuelem will not be inlined. Using...

Linux Distros Unpatched Vulnerability : CVE-2025-38202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Check rcureadlocktraceheld in bpfmaplookuppercpuelem bpfmaplookuppercpuelem helper is also available for sleepable bpf program. When BPF JIT is disabled or...

CVE-2025-38202 bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem()

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld in bpfmaplookuppercpuelem bpfmaplookuppercpuelem helper is also available for sleepable bpf program. When BPF JIT is disabled or under 32-bit host, bpfmaplookuppercpuelem will not be inlined. Using...

CVE-2024-35860

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...

CVE-2024-35860 bpf: support deferring bpf_link dealloc to after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...

CVE-2024-35860 bpf: support deferring bpf_link dealloc to after RCU grace period

In the Linux kernel, the following vulnerability has been resolved: bpf: support deferring bpflink dealloc to after RCU grace period BPF link for some program types is passed as a "context" which can be used by those BPF programs to look up additional information. E.g., for multi-kprobes and...

DEBIAN-CVE-2023-52621

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld before calling bpf map helpers These three bpfmaplookup,update,deleteelem helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program,...

CVE-2023-52621 bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld before calling bpf map helpers These three bpfmaplookup,update,deleteelem helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program,...

CVE-2023-52621

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcureadlocktraceheld before calling bpf map helpers These three bpfmaplookup,update,deleteelem helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program,...