ThreatCluster

Multiple CVEs Addressed in BPF Security Updates

First seen 18 Feb 2026, 12:23 UTC Api.Msrc.Microsoft 45

Article Content

Browse articles
ThreatCluster

Two new Common Vulnerabilities and Exposures (CVEs) related to the BPF subsystem were published on February 18, 2026. CVE-2025-37884 addresses a deadlock issue between rcu_tasks_trace and event_mutex, while CVE-2025-38202 checks rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem(). These vulnerabilities may affect systems utilizing BPF functionalities.

Timeline

2025-05-09
CVE-2025-37884 published
2025-07-04
CVE-2025-38202 published
2026-02-18
CVE-2025-37884 and CVE-2025-38202 information published