CVE-2026-68462
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel BPF subsystem, the verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. The issue arises because constant offsets were moved to reg->var_off, while __check_buffer_access() only checks the instruction offset. For writable raw tracepoints, an access with a negative offset can wrap the calculated end, allowing a program to bypass validation.
Risk Assessment
The vulnerability could allow an unprivileged user to bypass buffer access controls in BPF, potentially leading to privilege escalation or data integrity compromise.
Recommendation
It is recommended to update the Linux kernel to a version containing the fix that rejects negative constant offsets for buffer pointers in the BPF verifier.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") moved constant pointer offsets from reg->off to reg->var_off. However, __check_buffer_access() continued to check only the instruction offset. An access with reg->var_off equal to -8 and an instruction offset of zero therefore passes verification. For writable raw tracepoints, the access end is also calculated from the unsigned reg->var_off.value. An eight-byte access starting at -8 wraps the calculated end to zero, allowing the program to load and attach without increasing max_tp_access. After ensuring that reg->var_off is constant, calculate the effective access start using signed arithmetic and reject it when it is negative. Use the validated start to calculate the access end for both PTR_TO_TP_BUFFER and PTR_TO_BUF.