153 matches found
DEBIAN-CVE-2026-98085
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
AZL-104613 CVE-2026-98085 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
CVE-2026-98085
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
DEBIAN-CVE-2026-98048
In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...
UBUNTU-CVE-2026-98085
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
EUVD-2026-86915
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
CVE-2026-98085
The Linux kernel contains a vulnerability in the BPF precision backtracking mechanism affecting BPF_LD | BPF_{IND,ABS} instructions. The root cause is that the backtrack_insn() function fails to handle the implicit exit case from a subprogram. Specifically, it does not call bt_subprog_enter() whe...
EUVD-2026-86701
In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...
CVE-2026-98085: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
CVE-2026-98048
In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...
Linux Distros Unpatched Vulnerability : CVE-2026-98085
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions...
PT-2026-98748
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A bug exists in the precision backtracking mechanism for BPF LD | BPF IND,ABS instructions. These instructions are modeled as two branches: a fallthrough and an implicit exit from the...
Linux Distros Unpatched Vulnerability : CVE-2026-98048
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched spill; call; fill instruction series is not...
CVE-2026-98085
In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...
EUVD-2026-70243
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a TCTX-typed base register as a silent no-op: domemstore in src/crab/ebpftransformer.cpp only models TSTACK stores, and the...
PT-2026-84841
PREVAIL is a Polynomial-Runtime EBPF Verifier using an Abstract Interpretation Layer. Prior to version 0.2.4, the abstract transformer in prevail treats writes through a T CTX-typed base register as a silent no-op: do mem store in src/crab/ebpf transformer.cpp only models T STACK stores, and the...
JLSEC-2026-1350 Wasmtime provides unsound API access to a WebAssembly shared linear memory
Impact Wasmtime's Rust embedder API contains an unsound interaction where a WebAssembly shared linear memory could be viewed as a type which provides safe access to the host Rust to the contents of the linear memory. This is not sound for shared linear memories, which could be modified in paralle...
CVE-2026-55406 Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static u8, and the Deref...