In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix stack slot index in nospec checks
check_stack_write_fixed_off() computes the byte slot for a fixed-offset stack write as -off - 1, and records each written byte in slot_type[] with (slot - i) % BPF_REG_SIZE.
The Spectre v4 sanitization pre-check uses slot_type[i] instead. For a 4-byte write at fp-8 after the lower half of fp-8 has been zeroed, the pre-check scans bytes 0..3 and sees STACK_ZERO while the actual write updates bytes 7..4. That can leave the second half-slot write without nospec_result even though the bytes being overwritten still require sanitization.
Use the same slot index in the sanitization pre-check that the write path uses when updating slot_type[].
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade perf-debuginfoUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-develUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-modules-extra-commonUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.180-225.360 | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linux | Aug 16, 2026 | Aug 16, 2026 |
| Redhat_linux | — | No solution exists | Aug 18, 2026 | Aug 15, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 21, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub