CVE-2026-98377

In the Linux kernel, bpf_sock_destroy() reads sk_protocol from the wrong structure, causing an out-of-bounds read. The issue affects TIME_WAIT and request sockets passed by the TCP iterator. The fix restricts the sk_protocol check to full sockets only.

In the Linux kernel, LWT_SEG6LOCAL programs can invalidate the cached SRH and then call bpf_skb_pull_data(), leading to a dangling pointer and use-after-free. The fix disallows bpf_skb_pull_data() for LWT_SEG6LOCAL programs.

In the Linux kernel, the BPF device matching mechanism has a flaw that allows a program bound to one device to run on another, leading to memory corruption. The fix restricts non-offloaded programs to exact netdev matches.

In the Linux kernel, during veth channel resize, XDP program pointers are not cleared for removed RX queues. This can lead to running a freed program after a later channel increase, causing a system crash.

In the Linux kernel's net/sched subsystem, a vulnerability exists where tcf_action_delete() fails to check if the IDR lookup result is an error pointer (ERR_PTR). An attacker can exploit a race to replace an action with an error pointer, leading to a null-pointer dereference and kernel panic.

A vulnerability in the Linux kernel's netfilter ip6t_rpfilter module was found, where ip6_route_lookup() can return a route without an inet6_dev (NULL pointer). An unprivileged user can trigger this state by lowering an external interface's MTU below IPV6_MIN_MTU, leading to a NULL pointer dereference and kernel panic.

In the Linux kernel, a vulnerability exists in the BPF link iterator. bpf_link_prime() inserts a link into link_idr before the ID is published, and the link iterator takes a reference without checking whether the link is settled (ID zero). If anon_inode_getfile() fails, the iterator is left with a dangling reference and a subsequent bpf_link_put() accesses freed memory (use-after-free).

In the Linux kernel, the metadata comparison for percpu array BPF maps used as inner maps does not check max_entries. Replacing an inner map with a smaller one bypasses validation, and the index_mask inlined by the JIT can cause an out-of-bounds access to the pptrs[] array.

In the Linux kernel, the xen/netfront driver does not validate the length of the first RX slot against ETH_HLEN before calling eth_type_trans(). If the first slot is shorter than an Ethernet header, a BUG() may occur in __skb_pull() or the header may be read past the end of the data.

In the Linux kernel, a use-after-free vulnerability exists in tcp_send_synack() involving retransmit_skb_hint. When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original but tp->retransmit_skb_hint still points to the freed object, which can be exploited by an unprivileged TFO client to trigger a use-after-free.