In the Linux kernel, the following vulnerability has been resolved:

bpf: Tighten cgroup storage cookie checks for prog arrays

The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local
storage") is still incomplete. The prog-array compatibility check
treats a program with no cgroup storage as compatible with any stored
storage cookie. This allows a storage-less program to bridge a tail
call chain between an entry program and a storage-using callee even
though cgroup local storage at runtime still follows the caller's
context, that is, A -> B(no storage) -> C(storage) path.

Requiring exact cookie equality would break the legitimate case of a
storage-less leaf program being tail called from a storage-using one.
Instead, only accept a zero storage cookie if the program cannot
perform tail calls itself. This keeps A -> B(no storage) working
while rejecting the A -> B(no storage) -> C(storage) bridge.

https://git.kernel.org/stable/c/10627ddc0167aab5c1c390a10ef461e9937aba08

https://git.kernel.org/stable/c/1c762d28698483ce7c372091f34d86e4d4828652

https://git.kernel.org/stable/c/46fbafe3d2d569d828e8d24a7dbe1659f63685cf

https://git.kernel.org/stable/c/87177497cca90bf4fcfb759eb898560eb5b46a10

https://git.kernel.org/stable/c/9ca06849c4239aa2d580c54651f8588c51cb398b

https://git.kernel.org/stable/c/cb22dc79528eb26a46d346c3118dbd6b14c70609

https://git.kernel.org/stable/c/eb73056ce2a6f101ddd3bdba89af6b24ebffff85

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"c1c74584b9b4043c52e41fec415226e582d266a3","lessThan":"87177497cca90bf4fcfb759eb898560eb5b46a10","versionType":"git","status":"affected"},{"version":"66da7cee78590259b400e51a70622ccd41da7bb2","lessThan":"1c762d28698483ce7c372091f34d86e4d4828652","versionType":"git","status":"affected"},{"version":"7acfa07c585e3d7a64654d38f0a5c762877d0b9b","lessThan":"eb73056ce2a6f101ddd3bdba89af6b24ebffff85","versionType":"git","status":"affected"},{"version":"41688d1fc5d163a6c2c0e95c0419e2cb31a44648","lessThan":"9ca06849c4239aa2d580c54651f8588c51cb398b","versionType":"git","status":"affected"},{"version":"abad3d0bad72a52137e0c350c59542d75ae4f513","lessThan":"46fbafe3d2d569d828e8d24a7dbe1659f63685cf","versionType":"git","status":"affected"},{"version":"abad3d0bad72a52137e0c350c59542d75ae4f513","lessThan":"cb22dc79528eb26a46d346c3118dbd6b14c70609","versionType":"git","status":"affected"},{"version":"abad3d0bad72a52137e0c350c59542d75ae4f513","lessThan":"10627ddc0167aab5c1c390a10ef461e9937aba08","versionType":"git","status":"affected"},{"version":"19341d5c59e8c7e8528e40f8663e99d67810473c","versionType":"git","status":"affected"},{"version":"5.15.192","lessThan":"5.15.212","versionType":"semver","status":"affected"},{"version":"6.1.151","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.105","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.46","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.16.1","lessThan":"6.17","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/bpf/core.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]