{"apiVersion":"1.0","identifier":"CVE-2026-68462","description":"In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative const offsets for buffer pointers The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic. Commit 022ac0750883 (-bpf: use reg->var_off instead of reg->off for pointers-) moved constant pointer offsets from reg->off to reg->var_off. However, __check_buffer_access() continued to check only the instruction offset. An access with reg->var_off equal to -8 and an instruction offset of zero therefore passes verification. For writable raw tracepoints, the access end is also calculated from the unsigned reg->var_off.value. An eight-byte access starting at -8 wraps the calculated end to zero, allowing the program to load and attach without increasing max_tp_access. After ensuring that reg->var_off is constant, calculate the effective access start using signed arithmetic and reject it when it is negative. Use the validated start to calculate the access end for both PTR_TO_TP_BUFFER and PTR_TO_BUF.","publishedAt":"2026-08-15T06:18:39","lastModifiedAt":"2026-08-17T06:17:55","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-68462","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.0012,"riskScore":0.79,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-68462","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-68462","en":"https://www.redsauce.net/en/cves/CVE-2026-68462","fr":"https://www.redsauce.net/fr/cves/CVE-2026-68462","pt":"https://www.redsauce.net/pt/cves/CVE-2026-68462","de":"https://www.redsauce.net/de/cves/CVE-2026-68462","sk":"https://www.redsauce.net/sk/cves/CVE-2026-68462","el":"https://www.redsauce.net/el/cves/CVE-2026-68462"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-68462"}}