CVE-2026-68187

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

exec: fix unsigned loop counter wrap in transfer_args_to_stack()

The stop value is derived from bprm->p >> PAGE_SHIFT. The index variable

is an unsigned long. If bprm->p drops below PAGE_SIZE and stop becomes

zero the loop condition index >= stop is always true.

After the index == 0 iteration the decrement wraps to ULONG_MAX and

bprm->page[ULONG_MAX] reads sizeof(void *) bytes in front of the array.

The pointer has wrapped to -1. That garbage pointer is then passed to

kmap_local_page() and PAGE_SIZE bytes are copied from wherever that

lands into the stack of the process being created. And the loop doesn't

terminate either...

Getting there only requires bprm->p < PAGE_SIZE. On !MMU

bprm_set_stack_limit() and bprm_hit_stack_limit() are empty. So the only

constraint on how far bprm->p is pushed down is valid_arg_len(), i.e.

that each individual string still fits in what is left.

bprm->p starts at PAGE_SIZE * MAX_ARG_

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References