Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-45839

bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. "0:1:2" walks through nested struct members. bpf_core_parse_spec() parses each component with sscanf("%d"), so negative values like -1 are silently accepted. The subsequent bounds checks (access_idx >= btf_vlen(t)) only guard the upper bound and always pass for negative values because C integer promotion converts the __u16 btf_vlen result to int, making the comparison (int)(-1) >= (int)(N) false for any positive N. When -1 reaches btf_member_bit_offset() it gets cast to u32 0xffffffff, producing an out-of-bounds read far past the members array. A crafted BPF program with a negative CO-RE accessor on any struct that exists in vmlinux BTF (e.g. task_struct) crashes the kernel deterministically during BPF_PROG_LOAD on any system with CONFIG_DEBUG_INFO_BTF=y (default on major distributions). The bug is reachable with CAP_BPF: BUG: unable to handle page fault for address: ffffed11818b6626 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page Oops: Oops: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 85 Comm: poc Not tainted 7.0.0-rc6 #18 PREEMPT(full) RIP: 0010:bpf_core_parse_spec (tools/lib/bpf/relo_core.c:354) RAX: 00000000ffffffff Call Trace: <TASK> bpf_core_calc_relo_insn (tools/lib/bpf/relo_core.c:1321) bpf_core_apply (kernel/bpf/btf.c:9507) check_core_relo (kernel/bpf/verifier.c:19475) bpf_check (kernel/bpf/verifier.c:26031) bpf_prog_load (kernel/bpf/syscall.c:3089) __sys_bpf (kernel/bpf/syscall.c:6228) </TASK> CO-RE accessor indices are inherently non-negative (struct member index, array element index, or enumerator index), so reject them immediately after parsing.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • ddc7c3042614e273044f698d2beab25cc3842d45 to < c8e49b79c4b48bd687706ff6e9c82638dc81ef80affected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < a9e777f856cd2f1efc106afc7bf21aef868509d5affected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < 669349b4612c26b3d7aacfa99d7174681bd19223affected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < 3ff85ae79e1a74baeb916b78a63d821f6d19a994affected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < 36a9012f76ba8d9189ae56a1f8bb7c87c07a1f3aaffected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < 76f2ebaf79a9ae6d0737b87f045fe769e425d78faffected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < 99dbab7b5a12d8f58d5b0aa2f7a1fe656a70f4b2affected
  • ddc7c3042614e273044f698d2beab25cc3842d45 to < 1c22483a2c4bbf747787f328392ca3e68619c4dcaffected

Linux Linux

Default version status: affected

  • 5.4affected
  • 0 to < 5.4unaffected
  • 5.10.267 to ≤ 5.10.*unaffected
  • 5.15.209 to ≤ 5.15.*unaffected
  • 6.1.175 to ≤ 6.1.*unaffected
  • 6.6.141 to ≤ 6.6.*unaffected
  • 6.12.91 to ≤ 6.12.*unaffected
  • 6.18.33 to ≤ 6.18.*unaffected
  • 7.0.10 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References