In the Linux kernel, the following vulnerability has been resolved:
bpf, x86: Fix trampoline stack size for 128-bit arguments
btf_distill_func_proto() accepts a function argument up to 16 bytes, so a 128-bit scalar such as __int128 reaches the x86 trampoline with arg_size == 16. But the current implementation assumes an __int128 argument only needs one register, so the register save area is under-allocated and save_args() overwrites adjacent stack slots.
Compute the register count from arg_size for all arguments to fix it.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-tools-develUpgrade python3-perf6.18Upgrade kernel6.18-develUpgrade bpftool6.18Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18Upgrade kernel6.18-toolsUpgrade kernel6.18-tools-debuginfoUpgrade perf6.18Upgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-modules-extraUpgrade microvm-kernel6.18Upgrade kernel6.18-headersUpgrade kernel6.18-debuginfoUpgrade python3-perf6.18-debuginfoUpgrade bpftool6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel-livepatch-6.18.54-121.166 | Oct 13, 2026 | Sep 17, 2026 |
| Debian | — | Upgrade linuxUpgrade linux-6.12 | Sep 30, 2026 | Sep 17, 2026 |
| Redhat_linux | — | No solution exists | Oct 22, 2026 | Sep 17, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Sep 30, 2026 | Sep 17, 2026 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub