Homepage

Expired Pointer Dereference The advisory has been revoked - it doesn't affect any version of package bpftool  (opens in a new tab)

Threat Intelligence

EPSS
0.38% (31st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-BPFTOOL-17132994
  • published2 Jun 2026
  • disclosed26 May 2026
Report a new vulnerability Found a mistake?

Introduced: 26 May 2026

CVE-2026-46243  (opens in a new tab)
CWE-825  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream bpftool package and not the bpftool package as distributed by RHEL.

In the Linux kernel, the following vulnerability has been resolved:

smb: client: reject userspace cifs.spnego descriptions

cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin.

Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key.

References