CVE-2026-45839

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

CO-RE accessor strings are colon-separated indices that describe a path

from a root BTF type to a target field, e.g. "0:1:2" walks through

nested struct members. bpf_core_parse_spec() parses each component with

sscanf("%d"), so negative values like -1 are silently accepted. The

subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the

upper bound and always pass for negative values because C integer

promotion converts the __u16 btf_vlen result to int, making the

comparison (int)(-1) >= (int)(N) false for any positive N.

When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,

producing an out-of-bounds read far past the members array. A crafted

BPF program with a negative CO-RE accessor on any struct that exists in

vmlinux BTF (e.g. task_struct) crashes the kernel deterministically

during BPF_PROG_LOAD on any system with

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References