CVE-2026-92486bpf: Fix CFI mismatch in task work callback
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpf_callback_t ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpf_callback_t.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 38aa7003e369802f81a078f6673d10d97013f04f before 85a33c910edc3651f68b17ae3c597c012545958f; from 38aa7003e369802f81a078f6673d10d97013f04f before a2cbab47f44e9ea8c5a161ecba1b6bb8535771eb; from 38aa7003e369802f81a078f6673d10d97013f04f before 2805abd089576799b15092949420e3f8ba97fabd | CNA record |
References
- https://git.kernel.org/stable/c/85a33c910edc3651f68b17ae3c597c012545958f
- https://git.kernel.org/stable/c/a2cbab47f44e9ea8c5a161ecba1b6bb8535771eb
- https://git.kernel.org/stable/c/2805abd089576799b15092949420e3f8ba97fabd
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.