CVE-2026-68462 (GCVE-0-2026-68462)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:51 – Updated: 2026-08-17 05:39
VLAI
Title
bpf: Reject negative const offsets for buffer pointers
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") moved constant pointer offsets from reg->off to reg->var_off. However, __check_buffer_access() continued to check only the instruction offset. An access with reg->var_off equal to -8 and an instruction offset of zero therefore passes verification. For writable raw tracepoints, the access end is also calculated from the unsigned reg->var_off.value. An eight-byte access starting at -8 wraps the calculated end to zero, allowing the program to load and attach without increasing max_tp_access. After ensuring that reg->var_off is constant, calculate the effective access start using signed arithmetic and reject it when it is negative. Use the validated start to calculate the access end for both PTR_TO_TP_BUFFER and PTR_TO_BUF.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 022ac075088366b62e130da5e1b200bc93a47191 , < 314bd592085c0720ef519f6edbc5f41440ff78d4 (git)
Affected: 022ac075088366b62e130da5e1b200bc93a47191 , < fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 7.1
Unaffected: 0 , < 7.1 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "314bd592085c0720ef519f6edbc5f41440ff78d4",
              "status": "affected",
              "version": "022ac075088366b62e130da5e1b200bc93a47191",
              "versionType": "git"
            },
            {
              "lessThan": "fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9",
              "status": "affected",
              "version": "022ac075088366b62e130da5e1b200bc93a47191",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.1"
            },
            {
              "lessThan": "7.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "7.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative const offsets for buffer pointers\n\nThe verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF\naccesses, but it currently accepts a constant negative offset produced by\npointer arithmetic.\n\nCommit 022ac0750883 (\"bpf: use reg-\u003evar_off instead of reg-\u003eoff for\npointers\") moved constant pointer offsets from reg-\u003eoff to reg-\u003evar_off.\nHowever, __check_buffer_access() continued to check only the instruction\noffset. An access with reg-\u003evar_off equal to -8 and an instruction offset\nof zero therefore passes verification.\n\nFor writable raw tracepoints, the access end is also calculated from the\nunsigned reg-\u003evar_off.value. An eight-byte access starting at -8 wraps\nthe calculated end to zero, allowing the program to load and attach\nwithout increasing max_tp_access.\n\nAfter ensuring that reg-\u003evar_off is constant, calculate the effective\naccess start using signed arithmetic and reject it when it is negative.\nUse the validated start to calculate the access end for both\nPTR_TO_TP_BUFFER and PTR_TO_BUF."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in bpf_check() during bpf(BPF_PROG_LOAD); the path is bpf_prog_load() \u2192 bpf_check() \u2192 check_mem_access() \u2192 __check_buffer_access() on PTR_TO_TP_BUFFER/PTR_TO_BUF. Per kernel CNA guidance BPF verifier bugs are Local, not network-reachable.\nAC:L - Exploitation is deterministic: pointer arithmetic (e.g. r6 += -8) yields a constant negative reg-\u003evar_off that passes the insn-only check, and unsigned wrap sets max_tp_access/max_rdwr_access to zero. The attacker fully controls program bytecode and triggering with no race or layout dependency.\nPR:L - Affected BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE and BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER programs require CAP_BPF and CAP_PERFMON checked by bpf_token_capable(); BPF tokens delegate these capabilities into a non-init user namespace, so a namespace-local actor can reach bpf_prog_load without init-namespace root.\nUI:N - No victim interaction is required; after loading and attaching the malicious program the attacker triggers execution by reading a BPF iterator fd or causing a writable raw tracepoint to fire, entirely through their own syscalls.\nS:U - The verifier bypass permits out-of-bounds kernel reads/writes adjacent to tracepoint or iterator buffers within the same host kernel security authority; impact is standard kernel memory corruption and privilege escalation, not a VM, container, or IOMMU boundary crossing.\nC:H - Verified loads at negative offsets read up to eight bytes before PTR_TO_TP_BUFFER or PTR_TO_BUF targets, disclosing adjacent kernel stack or kmalloc memory (map keys/values, tracepoint writable buffers); per guidance out-of-bounds kernel reads warrant High confidentiality impact.\nI:H - Writable raw tracepoint programs can store at negative offsets while max_tp_access wraps to zero, and PTR_TO_BUF iterator contexts allow verified writes before map value buffers; these out-of-bounds stores corrupt adjacent kernel memory with a plausible control-flow hijack primitive.\nA:H - Out-of-bounds kernel memory accesses from attached BPF programs commonly provoke kernel oops or panic; the attacker can repeatedly trigger iterator reads or writable raw tracepoints to deny host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:39:09.532Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/314bd592085c0720ef519f6edbc5f41440ff78d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9"
        }
      ],
      "title": "bpf: Reject negative const offsets for buffer pointers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68462",
    "datePublished": "2026-08-15T05:51:21.948Z",
    "dateReserved": "2026-07-30T09:28:09.395Z",
    "dateUpdated": "2026-08-17T05:39:09.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68462",
      "date": "2026-09-21",
      "epss": "0.0012",
      "percentile": "0.02115"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "314bd592085c0720ef519f6edbc5f41440ff78d4",
                    "status": "affected",
                    "version": "022ac075088366b62e130da5e1b200bc93a47191",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9",
                    "status": "affected",
                    "version": "022ac075088366b62e130da5e1b200bc93a47191",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/bpf/verifier.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "7.1"
                  },
                  {
                    "lessThan": "7.1",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative const offsets for buffer pointers\n\nThe verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF\naccesses, but it currently accepts a constant negative offset produced by\npointer arithmetic.\n\nCommit 022ac0750883 (\"bpf: use reg-\u003evar_off instead of reg-\u003eoff for\npointers\") moved constant pointer offsets from reg-\u003eoff to reg-\u003evar_off.\nHowever, __check_buffer_access() continued to check only the instruction\noffset. An access with reg-\u003evar_off equal to -8 and an instruction offset\nof zero therefore passes verification.\n\nFor writable raw tracepoints, the access end is also calculated from the\nunsigned reg-\u003evar_off.value. An eight-byte access starting at -8 wraps\nthe calculated end to zero, allowing the program to load and attach\nwithout increasing max_tp_access.\n\nAfter ensuring that reg-\u003evar_off is constant, calculate the effective\naccess start using signed arithmetic and reject it when it is negative.\nUse the validated start to calculate the access end for both\nPTR_TO_TP_BUFFER and PTR_TO_BUF."
          }
        ],
        "id": "CVE-2026-68462",
        "lastModified": "2026-08-17T06:17:55.517",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:18:39.803",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/314bd592085c0720ef519f6edbc5f41440ff78d4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T15:00:08+00:00",
      "cve": "CVE-2026-68462",
      "id": "CVE-2026-68462",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Reject negative const offsets for buffer pointers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68462.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:33:16Z",
      "cve": "CVE-2026-68462",
      "id": "CVE-2026-68462",
      "initial_release_date": "2026-08-26T01:15:38Z",
      "product_status:known_affected": "245",
      "product_status:known_not_affected": "117",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68462",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68462.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.