GHSA-VJHX-2CQW-3Q6Q Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

Summary An unprivileged container can block all other containers from starting on the same host by placing a crafted /etc/ld.so.cache file in its filesystem. When Inspektor Gadget attaches any uprobe-based gadget, it parses this file in the container startup path. A malicious cache causes 53...

Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS

Summary An unprivileged container can block all other containers from starting on the same host by placing a crafted /etc/ld.so.cache file in its filesystem. When Inspektor Gadget attaches any uprobe-based gadget, it parses this file in the container startup path. A malicious cache causes 53...

SUSE CVE-2026-74477

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

CVE-2026-74477

In the Linux kernel, the following vulnerability has been resolved: uprobes: Fix NULL pointer dereference in hprobeexpire Forking a task that has a pending uretprobe can oops the kernel with a NULL pointer dereference in the clone path: BUG: kernel NULL pointer dereference, address:...

PT-2026-72545

In the Linux kernel, the following vulnerability has been resolved: uprobes/x86: Use proper mm struct in in uprobe trampoline In the unregister path we use in uprobe trampoline check with current-mm for the VMA lookup, which is wrong, because we are in the tracer context, not the traced process...

PT-2026-72694

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard get user acesss with access ok for uprobe multi data As reported by sashiko 1 we need to use access ok to check the user space data bounds before we use get-user to get it. 1...

SUSE CVE-2026-53095

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

PYSEC-2026-611 Malicious code in uprobe (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of uprobe were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...

CVE-2026-53095

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

CVE-2026-53095 bpf: Fix abuse of kprobe_write_ctx via freplace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

CVE-2026-53095 bpf: Fix abuse of kprobe_write_ctx via freplace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct ptregs. Since the actual program type of uprobe is KPROBE, it can be abused to modify struct ptregs via kprobe+freplace when the kprobe...

PT-2026-51989

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where kprobe write ctx can be abused via freplace. Because the actual program type of uprobe is KPROBE, it can be used to modify struct pt regs when ...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: kernel: Be more careful regarding failures with dupmmap and the registration of uprobes. If a memory allocation fails during dupmmap, the map tree can remain in an unsafe state for other iterators besides the exit path. All locks...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: riscv: The issue with the handling of SRSPIE set/clear operations during uprobe has been fixed. In riscv, the process of uprobe involves clearing the SPIE before executing the original instruction, and setting the SPIE after...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Support deferring bpflink deallocation to after RCU grace period For some program types, the “bpflink” is passed as a “context” that can be used by those BPF programs to retrieve additional information. For example, for...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-011328)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-011328 advisory. In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamicevents interface on...

Azure Linux 3.0 Security Update: kernel (CVE-2024-47675)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-47675 advisory. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix use-after-free in...

ROS-20260120-7315

A vulnerability in the uprobewriteopcode function of the kernel/events/uprobes.c module of the Linux kernel is related to incorrect calculation. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

EulerOS 2.0 SP12 : kernel (EulerOS-SA-2026-1071)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : net: drop UFO packets in udprcvsegmentCVE-2025-38622 A transient execution vulnerability in some AMD processors may allow an attacker to infer dat...