In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject negative offsets for ALU ops
When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer.
The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1).
This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-toolsUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-modules-extra-commonUpgrade kernel6.12-headersUpgrade python3-perf6.12-debuginfoUpgrade kernel-livepatch-6.12.53-69.119Upgrade perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-libbpfUpgrade kernel6.12-debuginfo-common-x86_64Upgrade bpftool6.12Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-libbpf-staticUpgrade bpftool6.12-debuginfoUpgrade kernel6.12-libbpf-debuginfoUpgrade kernel6.12-develUpgrade perf6.12-debuginfoUpgrade kernel6.12 | Dec 9, 2025 | Nov 12, 2025 |
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Nov 12, 2025 |
| Ubuntu | — | Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-gcp-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-aws-lts-24.04Upgrade linux-image-azureUpgrade linux-image-azure-6.8Upgrade linux-image-gkeopUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-oem-22.04Upgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-azure-fips-6.8Upgrade linux-image-generic-6.8Upgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-intel-iotgUpgrade linux-image-oem-22.04bUpgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-realtime-6.8.1Upgrade linux-image-raspiUpgrade linux-image-gcpUpgrade linux-image-gke-64k-6.8Upgrade linux-image-aws-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidiaUpgrade linux-image-azure-6.17Upgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-aws-6.17Upgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-aws-6.8Upgrade linux-image-6.8.0-1050-awsUpgrade linux-image-generic-64kUpgrade linux-image-ibmUpgrade linux-image-genericUpgrade linux-image-virtual-6.17Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-generic-64k-6.17Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-gke-6.8Upgrade linux-image-raspi-6.17Upgrade linux-image-6.8.0-106-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-fips-6.8Upgrade linux-image-raspi-6.8Upgrade linux-image-realtime-6.17Upgrade linux-image-gkeUpgrade linux-image-virtual-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-64kUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04dUpgrade linux-image-oracle-64kUpgrade linux-image-xilinxUpgrade linux-image-6.17.0-1008-azureUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-6.17Upgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-awsUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-aws-64k-6.17Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.17.0-14-generic-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-fipsUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-azure-fipsUpgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-kvmUpgrade linux-image-6.17.0-1007-awsUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.17.0-14-genericUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-6.17.0-1011-oemUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gkeop-6.8Upgrade linux-image-gke-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-virtualUpgrade linux-image-realtimeUpgrade linux-image-oracle-6.17Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-oracleUpgrade linux-image-gcp-64k-6.17Upgrade linux-image-oem-6.17Upgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-gcp-6.17Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1049-nvidia-64k | Feb 13, 2026 | Feb 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub