In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard conntrack opts error writes

The conntrack lookup and allocation kfuncs take an opts pointer
together with an opts__sz argument. The verifier checks only the memory
range described by opts__sz, but the wrappers unconditionally write
opts->error whenever the internal lookup or allocation helper returns an
error.

For an invalid size smaller than the end of opts->error, that write can
land outside the verifier-checked range. Keep returning NULL for invalid
arguments, but only report the error through opts->error when the
supplied size includes the field.

This preserves error reporting for the supported 12-byte and 16-byte
layouts, and for other invalid sizes that still include opts->error.

https://git.kernel.org/stable/c/6f6183a39533d727deaa5061cadae6dd9e6744d0

https://git.kernel.org/stable/c/dd74c80203842a21b2ebb9f70d1260d9aa20fa05

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/netfilter/nf_conntrack_bpf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","lessThan":"dd74c80203842a21b2ebb9f70d1260d9aa20fa05","versionType":"git","status":"affected"},{"version":"b4c2b9593a1c4c3a718370e34af28e817fd5e5c6","lessThan":"6f6183a39533d727deaa5061cadae6dd9e6744d0","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/netfilter/nf_conntrack_bpf.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]