|
Vulnerabilities
< Back

CVE-2026-45839

Updated on 27 May 2026

Severity

7.8 High severity

Details

CVSS score
7.8
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. “0:1:2” walks through nested struct members. bpf_core_parse_spec() parses each component with sscanf("%d"), so negative values like -1 are silently accepted. The subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the upper bound and always pass for negative values because C integer promotion converts the __u16 btf_vlen result to int, making the comparison (int)(-1) >= (int)(N) false for any positive N.

When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff, producing an out-of-bounds read far past the members array. A crafted BPF program with a negative CO-RE accessor on any struct that exists in vmlinux BTF (e.g. task_struct) crashes the kernel deterministically during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y (default on major distributions). The bug is reachable with CAP_BPF:

BUG: unable to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354) RAX: 00000000ffffffff Call Trace: <TASK> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321) bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf (kernel/bpf/syscall.c:6228) </TASK>

CO-RE accessor indices are inherently non-negative (struct member index, array element index, or enumerator index), so reject them immediately after parsing.

Details

Affected product:
AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , Ubuntu 20.04 ELS
Affected packages:
linux-meta @ 5.4.0 (+5 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Amazon Linux 2023 Released
57 kernels
  • 6.1.79-99.164.amzn2023
  • 6.1.84-99.169.amzn2023
  • 6.1.82-99.168.amzn2023
  • 6.1.90-99.173.amzn2023
  • 6.1.87-99.174.amzn2023
  • 6.1.91-99.172.amzn2023
  • 6.1.97-104.177.amzn2023
  • 6.1.94-99.176.amzn2023
  • 6.1.102-108.177.amzn2023
  • 6.1.106-116.188.amzn2023
  • 6.1.102-111.182.amzn2023
  • 6.1.79-99.167.amzn2023
  • 6.1.92-99.174.amzn2023
  • 6.1.96-102.177.amzn2023
  • 6.1.109-118.189.amzn2023
  • 6.1.112-122.189.amzn2023
  • 6.1.111-120.187.amzn2023
  • 6.1.115-126.197.amzn2023
  • 6.1.119-129.201.amzn2023
  • 6.1.124-134.200.amzn2023
  • 6.1.127-135.201.amzn2023
  • 6.1.128-136.201.amzn2023
  • 6.1.129-138.220.amzn2023
  • 6.1.130-139.222.amzn2023
  • 6.1.131-143.221.amzn2023
  • 6.1.132-147.221.amzn2023
  • 6.1.134-150.224.amzn2023
  • 6.1.112-124.190.amzn2023
  • 6.1.140-154.222.amzn2023
  • 6.1.141-155.222.amzn2023
  • 6.1.134-152.225.amzn2023
  • 6.1.144-170.251.amzn2023
  • 6.1.147-172.266.amzn2023
  • 6.1.148-173.267.amzn2023
  • 6.1.150-174.273.amzn2023
  • 6.1.141-165.249.amzn2023
  • 6.1.141-167.250.amzn2023
  • 6.1.147-172.259.amzn2023
  • 6.1.153-175.280.amzn2023
  • 6.1.155-176.282.amzn2023
  • 6.1.156-177.286.amzn2023
  • 6.1.158-178.288.amzn2023
  • 6.1.159-181.297.amzn2023
  • 6.1.163-186.299.amzn2023
  • 6.1.158-180.294.amzn2023
  • 6.1.159-182.297.amzn2023
  • 6.1.161-183.298.amzn2023
  • 6.1.164-196.303.amzn2023
  • 6.1.166-197.305.amzn2023
  • 6.1.168-203.330.amzn2023
  • 6.1.168-202.320.amzn2023
  • 6.1.170-210.320.amzn2023
  • 6.1.170-213.321.amzn2023
  • 6.1.172-216.329.amzn2023
  • 6.1.174-217.345.amzn2023
  • 6.1.172-216.339.amzn2023
  • 6.1.170-208.319.amzn2023
Debian 12 Released
40 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
Debian 13 Released
10 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.69-1
  • 6.12.74-2
Ubuntu 22.04 Planned —
Ubuntu 24.04 Released
46 kernels
  • 6.8.0-35.35
  • 6.8.0-38.38
  • 6.8.0-36.36
  • 6.8.0-39.39
  • 6.8.0-40.40
  • 6.8.0-41.41
  • 6.8.0-44.44
  • 6.8.0-45.45
  • 6.8.0-31.31
  • 6.8.0-47.47
  • 6.8.0-48.48
  • 6.8.0-49.49
  • 6.8.0-50.51
  • 6.8.0-51.52
  • 6.8.0-52.53
  • 6.8.0-54.56
  • 6.8.0-55.57
  • 6.8.0-53.55
  • 6.8.0-56.58
  • 6.8.0-57.59
  • 6.8.0-58.60
  • 6.8.0-59.61
  • 6.8.0-60.63
  • 6.8.0-62.65
  • 6.8.0-63.66
  • 6.8.0-64.67
  • 6.8.0-71.71
  • 6.8.0-78.78
  • 6.8.0-79.79
  • 6.8.0-84.84
  • 6.8.0-85.85
  • 6.8.0-83.83
  • 6.8.0-86.87
  • 6.8.0-87.88
  • 6.8.0-88.89
  • 6.8.0-90.91
  • 6.8.0-94.96
  • 6.8.0-100.100
  • 6.8.0-101.101
  • 6.8.0-106.106
  • 6.8.0-107.107
  • 6.8.0-110.110
  • 6.8.0-111.111
  • 6.8.0-117.117
  • 6.8.0-124.124
  • 6.8.0-134.134