CVE-2026-68462

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Reject negative const offsets for buffer pointers

The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF

accesses, but it currently accepts a constant negative offset produced by

pointer arithmetic.

Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for

pointers") moved constant pointer offsets from reg->off to reg->var_off.

However, __check_buffer_access() continued to check only the instruction

offset. An access with reg->var_off equal to -8 and an instruction offset

of zero therefore passes verification.

For writable raw tracepoints, the access end is also calculated from the

unsigned reg->var_off.value. An eight-byte access starting at -8 wraps

the calculated end to zero, allowing the program to load and attach

without increasing max_tp_access.

After ensuring that reg->var_off is constant, calculate the effective

access start using signed arithmetic and reject it when it is

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References