CVE-2026-98084

The Linux kernel contains a vulnerability in the BPF verifier related to bpf_loop(). When processing callbacks, the verifier is intended to mark register R1 (which tracks loop iterations) as precise to satisfy callback_depth

CVE-2026-98084 bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

CVE-2026-98061 bpf: Reject tail calls directly from callback frames

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

CVE-2026-98061 bpf: Reject tail calls directly from callback frames

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

EUVD-2026-86714

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

EUVD-2026-86697

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98044 bpf: Reject legacy packet loads from callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98044 bpf: Reject legacy packet loads from callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98044

The Linux kernel contains a vulnerability in the BPF verifier where legacy packet-load instructions (BPF_LD_ABS or BPF_LD_IND ) used within synchronous callbacks trigger a "callback unexpected regs" verifier bug. Because check_ld_abs() models failed loads as implicit returns with R0 set to zero, ...

CVE-2026-98038 bpf: Keep refcount_acquire nullable for borrowed RCU kptrs

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcountacquire nullable for borrowed RCU kptrs bpfrefcountacquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KFRETNULL on the return value...

CVE-2026-98134

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

Linux Distros Unpatched Vulnerability : CVE-2026-98044

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It cal...

Linux Distros Unpatched Vulnerability : CVE-2026-98134

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug...

CVE-2026-98151: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

CVE-2026-98151

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

CVE-2026-98134: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

Linux Distros Unpatched Vulnerability : CVE-2026-98084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iteration...

CVE-2026-98084: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

CVE-2026-98044

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

Linux Distros Unpatched Vulnerability : CVE-2026-98007

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such...