{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-45839", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-45839", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-05-27T09:24:37.855Z", "updatedAt": "2026-10-15T01:19:41.412Z", "importedAt": "2026-10-24T01:58:14.884Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()\n\nCO-RE accessor strings are colon-separated indices that describe a path\nfrom a root BTF type to a target field, e.g. \"0:1:2\" walks through\nnested struct members. bpf_core_parse_spec() parses each component with\nsscanf(\"%d\"), so negative values like -1 are silently accepted. The\nsubsequent bounds checks (access_idx >= btf_vlen(t)) only guard the\nupper bound and always pass for negative values because C integer\npromotion converts the __u16 btf_vlen result to int, making the\ncomparison (int)(-1) >= (int)(N) false for any positive N.\n\nWhen -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff,\nproducing an out-of-bounds read far past the members array. A crafted\nBPF program with a negative CO-RE accessor on any struct that exists in\nvmlinux BTF (e.g. task_struct) crashes the kernel deterministically\nduring BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y\n(default on major distributions). The bug is reachable with CAP_BPF:\n\n BUG: unable to handle page fault for address: ffffed11818b6626\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full)\n RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354)\n RAX: 00000000ffffffff\n Call Trace:\n \n bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321)\n bpf_core_apply (kernel/bpf/btf.c:9507)\n check_core_relo (kernel/bpf/verifier.c:19475)\n bpf_check (kernel/bpf/verifier.c:26031)\n bpf_prog_load (kernel/bpf/syscall.c:3089)\n __sys_bpf (kernel/bpf/syscall.c:6228)\n \n\nCO-RE accessor indices are inherently non-negative (struct member index,\narray element index, or enumerator index), so reject them immediately\nafter parsing.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "c8e49b79c4b48bd687706ff6e9c82638dc81ef80" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "a9e777f856cd2f1efc106afc7bf21aef868509d5" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "669349b4612c26b3d7aacfa99d7174681bd19223" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "3ff85ae79e1a74baeb916b78a63d821f6d19a994" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3a" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "76f2ebaf79a9ae6d0737b87f045fe769e425d78f" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2" }, { "version": "ddc7c3042614e273044f698d2beab25cc3842d45", "status": "affected", "versionType": "git", "lessThan": "1c22483a2c4bbf747787f328392ca3e68619c4dc" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "5.4", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "5.4" }, { "version": "5.10.267", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.209", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.175", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.141", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.91", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.33", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.0.10", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.0.*" }, { "version": "7.1", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }