CVE-2026-99129

In the Linux kernel, the following vulnerability has been resolved:

selinux: fix BPF token permission checks

Avoid multiple lookups of the bpffs creator SID using the token's file descriptor when the same information can be found via the resolved path/dentry (in selinux bpf token create()) or the token itself (in selinux bpf map create() and selinux bpf prog load()). Not only does this simplify the code, it avoids potential TOCTOU issues if the user changes the token file descriptor passed into the kernel.