https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 03:57:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74590 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions</p> <p>The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of the memory are stable. kfuncs are expected to remain memory-safe even if concurrent modifications occur.</p> <p>bpf_get_fsverity_digest() didn&#39;t follow that: it could crash if arg-&gt;digest_size was concurrently modified.</p> <p>Fix that by using the known-good value hash_alg-&gt;digest_size instead.</p> <p>Also widen &#39;dynptr_sz&#39; and &#39;out_digest_sz&#39; to u64 to match the return type of __bpf_dynptr_size(). It doesn&#39;t appear that it can actually be more than INT_MAX currently (since __bpf_dynptr_data_rw() excludes file-based pointers), but the correct type might as well be used.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions</p> <p>The BPF verifier and the dynptr abstraction ensure that the memory space referenced by a dynptr remains valid. They do not, however, provide any guarantee that the contents of the memory are stable. kfuncs are expected to remain memory-safe even if concurrent modifications occur.</p> <p>bpf_get_fsverity_digest() didn&#39;t follow that: it could crash if arg-&gt;digest_size was concurrently modified.</p> <p>Fix that by using the known-good value hash_alg-&gt;digest_size instead.</p> <p>Also widen &#39;dynptr_sz&#39; and &#39;out_digest_sz&#39; to u64 to match the return type of __bpf_dynptr_size(). It doesn&#39;t appear that it can actually be more than INT_MAX currently (since __bpf_dynptr_data_rw() excludes file-based pointers), but the correct type might as well be used.</p> https://vulnerability.circl.lu/vuln/cve-2026-74590