{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-45903",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-45903",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-05-27T12:17:11.382Z",
    "updatedAt": "2026-05-27T12:17:11.382Z",
    "importedAt": "2026-10-24T01:58:14.884Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "bpf: Fix memory access flags in helper prototypes",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix memory access flags in helper prototypes\n\nAfter commit 37cce22dbd51 (\"bpf: verifier: Refactor helper access type tracking\"),\nthe verifier started relying on the access type flags in helper\nfunction prototypes to perform memory access optimizations.\n\nCurrently, several helper functions utilizing ARG_PTR_TO_MEM lack the\ncorresponding MEM_RDONLY or MEM_WRITE flags. This omission causes the\nverifier to incorrectly assume that the buffer contents are unchanged\nacross the helper call. Consequently, the verifier may optimize away\nsubsequent reads based on this wrong assumption, leading to correctness\nissues.\n\nFor bpf_get_stack_proto_raw_tp, the original MEM_RDONLY was incorrect\nsince the helper writes to the buffer. Change it to ARG_PTR_TO_UNINIT_MEM\nwhich correctly indicates write access to potentially uninitialized memory.\n\nSimilar issues were recently addressed for specific helpers in commit\nac44dcc788b9 (\"bpf: Fix verifier assumptions of bpf_d_path's output buffer\")\nand commit 2eb7648558a7 (\"bpf: Specify access type of bpf_sysctl_get_name args\").\n\nFix these prototypes by adding the correct memory access flags.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "37cce22dbd51a3ef7f6c08c3fb5f1c5075a17fbb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "fdfe75161f6e8c41a7d3023fbb815b537107b806"
            },
            {
              "version": "37cce22dbd51a3ef7f6c08c3fb5f1c5075a17fbb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "aa319592892068bd960c1a1c07bd621085b0c63d"
            },
            {
              "version": "37cce22dbd51a3ef7f6c08c3fb5f1c5075a17fbb",
              "status": "affected",
              "versionType": "git",
              "lessThan": "802eef5afb1865bc5536a5302c068ba2215a1f72"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.14",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.14"
            },
            {
              "version": "6.18.14",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "version": "7.0",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}