In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPF_PSEUDO_FUNC reference to the main program fixups.c:jit_subprogs() rewrites BPF_PSEUDO_FUNC loads to contain real function addresses. This function is invoked from bpf_jit_subprogs() only when env->subprog_cnt > 1. Meaning that for any program like below: int main(void *ctx) { void *ptr = main; ... bpf_timer_set_callback(..., ptr); ... } The 'ptr' won't be ever converted to contain an address. In combination with e.g. bpf_timer_set_callback() this would lead to a function call at a bogus address. Instead of complicating the implementation, just assume that no useful program needs main to be a sync or async callback and reject BPF_PSEUDO_FUNC loads for the main subprogram.
This vulnerability in the Linux kernel concerns improper handling of kthread_run() failures. Specifically, the kernel incorrectly used WARN_ON() when __kthread_create_on_node() returned -EINTR due to SIGKILL, causing unnecessary warnings. This issue has been resolved in fixed commits.
CVE-2026-98143 is a vulnerability in the Linux kernel's ethosu accelerator driver where the U65 hardware rounding mode was incorrectly interpreted as a storage mode. This misinterpretation caused command stream failures and incorrect computations on U65 hardware, notably impacting operations such as average pooling and other functions in the Mesa graphics stack. The issue was fixed by ensuring the field is read as a storage mode only on hardware where it applies, preventing command stream creation errors and incorrect feature map calculations.
A vulnerability in the Linux kernel's BPF verifier involves improper handling of scalar zero spills on the stack, where zero spills are downgraded to STACK_ZERO incorrectly. This flaw breaks precision propagation chains during verification. The issue has been fixed by avoiding the conversion of stack spills of zero to STACK_ZERO in the kernel code.
A vulnerability in the Linux kernel's af_packet subsystem involves improper casting of the tpacket_hdr.tp_len field from u32 to int in the tpacket_parse_header() function. This can cause incorrect length checks and lead to negative values being returned, triggering a kernel BUG in sock_sendmsg_nosec(). The issue was reported by syzbot and fixed in subsequent kernel commits.
A vulnerability in the Linux kernel's BPF verifier related to the handling of loop iteration counters in bpf_loop() was fixed. The verifier incorrectly cleared precision markings on certain registers during backtracking, potentially allowing unsafe BPF programs to be accepted. This issue affects Linux kernel versions from 6.6.15 up to but not including 6.6.160, and version 6.7. The flaw has been addressed in Linux kernel version 6.6.160 and later.
CVE-2026-98068 is a vulnerability in the Linux kernel's RDS networking subsystem where a race condition in connection shutdown handling can cause a socket to remain established indefinitely. This occurs when concurrent drops and shutdown passes interfere, leaving the path stuck in a down state with an active socket that is never properly torn down. The issue can cause receive queues to grow without being processed and the peer's send path to become blocked. The vulnerability affects Linux kernel version 4.12 and has been fixed in subsequent commits.
A vulnerability in the Linux kernel's BPF subsystem involves incorrect rewriting of bpf_fastcall instruction patterns when entered by a jump. The flaw occurs because the function mark_fastcall_pattern_for_call() did not properly ensure that the 'spill; call; fill' instruction sequence was uninterrupted by jumps, leading to unsound rewrites by bpf_remove_fastcall_spills_fills(). This has been fixed by recording jump targets to prevent pattern growth beyond jump instructions.
CVE-2026-98043 is a vulnerability in the Linux kernel's BPF verifier where a pointer with an unbounded offset is incorrectly inferred as non-NULL. This can lead to a NULL pointer dereference at runtime when the verifier assumes a pointer is valid based on its type alone, despite the actual runtime offset potentially resulting in a NULL value. The issue is fixed by requiring the offset to be within a defined bound in the verifier logic.
A vulnerability in the Linux kernel's BPF subsystem involves improper handling of scalar register IDs during linked register collection, which could lead to incorrect register state synchronization. The issue was fixed by changing the order of linked register collection to prevent resurrection of dropped scalar IDs. This fix addresses potential inaccuracies in register state tracking within BPF programs.
CVE-2026-98041 is a high-severity vulnerability in the Linux kernel affecting version 5.8. It involves incorrect prediction of jump instructions in BPF programs, specifically JMP32 pointer versus zero comparisons. This flaw caused the kernel to misinterpret certain conditional jumps, potentially leading to incorrect program behavior. The issue has been resolved in several fixed commits.
CVE-2026-97993 is a vulnerability in the Linux kernel's vhost-vdpa component where an error return from eventfd_ctx_fdget() is temporarily stored in v->config_ctx before being checked. This causes a brief window where v->config_ctx holds an ERR_PTR, which can lead to improper handling of config interrupts and silent failure of config interrupt delivery after an EBADF error. The issue was fixed by checking the file descriptor before installing it, preventing the error pointer from being assigned and preserving the validity invariant of v->config_ctx.
A vulnerability in the Linux kernel's ice network driver involves dereferencing pointers in TP_printk() after the event has been recorded, which can lead to invalid pointer access. This issue was identified due to new tracing subsystem checks that warn about double dereferences in trace events. The flaw was fixed by copying scalar values into the event instead of dereferencing pointers during printing.
A vulnerability in the Linux kernel's net/sched cls_api component causes excessive CPU usage and a hung task condition when a netlink socket repeatedly sends RTM_GETCHAIN requests without receiving responses. This occurs because the tc_ctl_chain() function replays RTM_GETCHAIN requests unnecessarily, leading to CPU hogging and potential system instability. The issue arises from improper handling of netlink socket receive buffer full conditions and incorrect replay logic applied to RTM_GETCHAIN messages.