Linux Linux Kernel Improper Validation Of Array Index Rated 7.8 CVSS

Status: UPDATED  |  Advisory ID: CVE-2026-45839

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

CO-RE accessor strings are colon-separated indices that describe a path

from a root BTF type to a target field, e.g. "0:1:2" walks through

nested struct members. bpf_core_parse_spec() parses each component with

sscanf("%d"), so negative values like -1 are silently accepted. The

subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the

upper bound and always pass for negative values because C integer

promotion converts the __u16 btf_vlen result to int, making the

comparison (int)(-1) >= (int)(N) false for any positive N.

When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,

producing an out-of-bounds read far past the members array. A crafted

BPF program with a negative CO-RE accessor on any struct that exists in

vmlinux BTF (e.g. task_struct) crashes the kernel deterministically

during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y

(default on major distributions). The bug is reachable with CAP_BPF:

BUG: unable to handle page fault for address: ffffed11818b6626

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)

RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)

RAX: 00000000ffffffff

Call Trace:

<TASK>

bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)

bpf_core_apply (kernel/bpf/btf.c:9507)

check_core_relo (kernel/bpf/verifier.c:19475)

bpf_check (kernel/bpf/verifier.c:26031)

bpf_prog_load (kernel/bpf/syscall.c:3089)

__sys_bpf (kernel/bpf/syscall.c:6228)

</TASK>

CO-RE accessor indices are inherently non-negative (struct member index,

array element index, or enumerator index), so reject them immediately

after parsing. (NVD)

What to Do

Monitor Linux's and Siemens's web pages for any future patch releases.

References