EUVD-2026-81752

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

CVE-2026-90159

CVE-2026-90159 affects the Linux kernel BPF subsystem. The _bpf_setsockopt() and _bpf_getsockopt() helpers call sock_owned_by_me(), which expects the socket lock to be held. However, the BPF_CGROUP_UNIX_GETPEERNAME and BPF_CGROUP_UNIX_GETSOCKNAME hooks execute BPF programs without acquiring that ...

CVE-2026-90159 bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

CVE-2026-90159 bpf: Disallow bpf_{g,s}etsockopt() in cgroup UNIX getname hooks

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

EUVD-2026-81750

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90157

CVE-2026-90157 affects the Linux kernel BPF cgroup getsockopt hook. A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler runs. The kernel-buffer variant (used by TCP_ZEROCOPY_RECEIVE ) only rejects values larger than the original length, so a negative optl...

CVE-2026-90157 bpf: Reject negative optlen in cgroup getsockopt hook

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90157 bpf: Reject negative optlen in cgroup getsockopt hook

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90078 net/sched: act_skbmod: fix length calculations and avoid invalid header warnings

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...

CVE-2026-90067

CVE-2026-90067 is a Linux kernel vulnerability in the Ceph messenger v2 protocol implementation (net/ceph/messenger_v2.c). When parsing the msgr2 protocol banner, a client sending a payload_len of 0 causes the kernel to set up a 0-length socket read , violating a state-machine invariant and trigg...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

EUVD-2026-81928

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

CVE-2026-90067 libceph: validate banner payload length

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

EUVD-2026-81916

In the Linux kernel, the following vulnerability has been resolved: usb: atm: usbatm: fix invalid cirange initialization syzbot reported a shift-out-of-bounds in vccconnect: UBSAN: shift-out-of-bounds in net/atm/common.c:382:32 shift exponent -1 is negative CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18...

CVE-2026-93113: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: unregister CAMCCGDSCCLK With the introduction of syncstate support in the clk and pmdomain subsystems, the following warning happens when the unused clocks are shutdown in camcc-sc8280xp: 15.408367...

CVE-2026-92485: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARNING in bpftracinglinkrelease The trampoline could be corrupted by the blindly 'tr-flags = BPFTRAMPFTAILCALLCTX' in verifier. 1. A fexit attached to a tailcallreachable prog. 'tr-flags' became 'BPFTRAMPFCALLORIG |...

PT-2026-94793

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF subsystem where the trampoline could be corrupted due to the incorrect assignment of tr-flags in the verifier. When a fexit is attached to a tail call reachabl...

PT-2026-94409

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter nf tables component where both the dynset and newsetelem paths perform a double clone of existing set expressions when setting set element expressions...

CVE-2026-90190: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

PT-2026-94508

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the lwt bpf component where the headroom check after an LWT XMIT BPF program is insufficient. The ip finish output2 function expands a socket buffer skb to LL RESERVED...