CVE-2026-90359

CVE-2026-90359 affects the Linux kernel BPF subsystem. The btf_distill_func_proto() function, which builds the function model for fentry/fexit/fmod_ret/fsession trampolines and struct_ops , has accepted 16-byte __int128 return values since the trampoline was introduced. However, the BPF trampolin...

CVE-2026-90358

CVE-2026-90358 affects the Linux kernel BPF subsystem on x86 . The root cause is in the x86 trampoline: when a BPF program is called with a 128-bit scalar argument (e.g., __int128, arg_size == 16), the trampoline incorrectly assumes it needs only one register. This under-allocates the register sa...

CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

EUVD-2026-82019

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90358 bpf, x86: Fix trampoline stack size for 128-bit arguments

In the Linux kernel, the following vulnerability has been resolved: bpf, x86: Fix trampoline stack size for 128-bit arguments btfdistillfuncproto accepts a function argument up to 16 bytes, so a 128-bit scalar such as int128 reaches the x86 trampoline with argsize == 16. But the current...

CVE-2026-90210 bpf: Fix UAF in bpf_trampoline_multi_attach_free on update failure

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpftrampolinemultiattachfree on update failure When bpftrampolineupdate fails before modifyfentrymulti/ unregisterfentrymulti is called, curimage is unchanged curimage == oldimage and ftrace still calls into it...

PT-2026-94707

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF trampoline mechanism where return values exceeding 8 bytes are not fully preserved. Specifically, the btf distill func proto function allows 16-byte int128...

CVE-2026-92485: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpftracinglinkrelease The trampoline could be corrupted by the blindly 'tr-flags = BPFTRAMPFTAILCALLCTX' in verifier. 1. A fexit attached to a tailcallreachable prog. 'tr-flags' became 'BPFTRAMPFCALLORIG |...

PT-2026-94558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the bpf trampoline multi attach free function. This occurs when bpf trampoline update fails before the modify fentry multi or unregister fentry multi...

DEBIAN-CVE-2026-89903

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

CVE-2026-89903

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

CVE-2026-89903

CVE-2026-89903 affects the Linux kernel on the LoongArch architecture, specifically the rethook trampoline (previously the kretprobe trampoline since v6.3 ). The trampoline incorrectly saves and restores $r21 (the per-CPU base register) across its entry/exit frame. If a task migrates CPUs between...

CVE-2026-89903 LoongArch: Do not save/restore percpu base register in rethook trampoline

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

CVE-2026-89903 LoongArch: Do not save/restore percpu base register in rethook trampoline

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

CVE-2026-89903: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

PT-2026-93544

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.3 and later Description An issue exists in the LoongArch architecture where the rethook trampoline incorrectly saves and restores the $r21 $u0 register, which serves as the percpu base. When rethook trampoline handler...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: ftrace: Fixed NULL pointer dereferencing in isftracetrampoline when ftrace is disabled. ftracestartup does not remove ops from ftraceopslist when ftracestartupenable fails: registerftracefunction ftracestartup...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: A potential array overflow has been fixed in bpftrampolinegetprogs. The cnt value in the cnt = BPFMAXTRAMPPROGS check does not include BPFTRAMPMODIFYRETURN bpf programs. As a result, the number of BPFTRAMPMODIFYRETURN bpf...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Added preemptcountsub,add to the btf id deny list. The recursion checks in bpfprogenter and bpfprogexit leave preemptcountsub,add unprotected. When attaching a trampoline to them, a panic occurs as follows: 867.843050 BUG...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: BPF: Fixed a UAF issue in bpftrampolinelinkcgroupshim The root cause of this bug is that when ‘bpflinkput’ reduces the refcount of ‘shimlink-link.link’ to zero, the resource is considered released, but may still be referenced via...