CVE-2026-72402 bpf: Mask pseudo pointer values in verifier logs

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs printbpfinsn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPFPSEUDOMAPFD and BPFPSEUDOMAPVALUE...

CVE-2026-72401

CVE-2026-72401 affects the Linux kernel’s BPF verifier path. The root cause is a leak of env->insn_aux_data when allocation of env->succ fails after env->insn_aux_data is allocated, due to vfree being placed before the err_free_env path. The fix moves vfree(env->insn_aux_data) into er...

EUVD-2026-59069

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

CVE-2026-72111

CVE-2026-72111 concerns the Linux kernel BPF verifier. When processing an LSM hook return value, the verifier narrows the destination register with __mark_reg_s32_range(), but intersects the new bounds with the existing ones instead of replacing them. If earlier instructions left stale bounds (e....

CVE-2026-72111 bpf: Reset register bounds before narrowing retval range in check_mem_access()

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in checkmemaccess When the BPF verifier processes a context load of an LSM hook return value, it calls markregs32range to narrow the register to the hook's valid range...

EUVD-2026-59084

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

CVE-2026-68462

The CVE-2026-68462 issue affects the Linux kernel’s BPF verifier, where negative constant offsets for buffer pointers (PTR_TO_TP_BUFFER and PTR_TO_BUF) could bypass verification due to a mismatch between reg->var_off and the instruction offset. The fix standardizes the handling by ensuring reg...

CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTRTOTPBUFFER and PTRTOBUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit...

PT-2026-72611

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts sz argument. The verifier checks only the memory range described by opts sz, but the wrappers...

PT-2026-72774

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject sleepable BPF LSM CGROUP programs at load time The cgroup shim runs under rcu read lock dont migrate, so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts...

PT-2026-72590

In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print bpf insn masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF PSEUDO MAP FD and BPF PSEUDO MAP VALUE...

PT-2026-72589

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn aux data leak on verifier err free env path When bpf check allocates env-insn aux data successfully but later fails to allocate env-succ, it jumps directly to err free env. The existing vfreeenv-insn aux data sits...

PT-2026-72300

In the Linux kernel, the following vulnerability has been resolved: bpf: Reset register bounds before narrowing retval range in check mem access When the BPF verifier processes a context load of an LSM hook return value, it calls mark reg s32 range to narrow the register to the hook's valid range...

CVE-2026-12364

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

EUVD-2026-58750

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

CVE-2026-12364 Missing user-space pointer validation in logging syscall z_log_msg_static_create allows kernel memory disclosure and denial of service

The user-space system-call verifier zvrfyzlogmsgstaticcreate in subsys/logging/logmsg.c was a pure pass-through: it forwarded the caller-supplied source, desc, package, and data arguments directly to the kernel-mode implementation zimplzlogmsgstaticcreate without performing any of the mandatory...

GO-2024-3116 vulnerabilities

Vulnerabilities for packages: slsa-verifier, cosign-fips, gh, cosign...

GO-2026-4348 vulnerabilities

Vulnerabilities for packages: cloudbeat-fips, image-factory, falcoctl-fips, goreleaser, slsa-verifier, trivy-operator-fips, sigstore-scaffolding, kubescape, trivy, kyverno-notation-aws, sigstore-scaffolding-fips, chainctl, policy-controller-fips, spire-server, falcoctl, skaffold-fips, ko-fips,...

GO-2024-3166 vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, sigstore-scaffolding, kubescape, trivy, melange, sigstore-scaffolding-fips, policy-controller-fips, chainctl, spire-server, falcoctl, cosign-fips, flux-source-controller-fips, spire-server-fips, flux-source-controller, tekton-chains-fips...

GO-2024-2719 vulnerabilities

Vulnerabilities for packages: slsa-verifier, falcoctl-fips, goreleaser, kubescape, melange, policy-controller-fips, chainctl, spire-server, falcoctl, ko-fips, spire-server-fips, flux-source-controller, tekton-chains-fips, tkn-fips, vexctl, ko, neuvector-sigstore-interface, apko, tkn, zarf,...