CVE-2026-68462 bpf: Reject negative const offsets for buffer pointers
A flaw in the Linux kernel BPF verifier allows negative offsets to bypass bounds checks, potentially enabling privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68462?
CVE-2026-68462 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
bpf: Reject negative const offsets for buffer pointers
The verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF accesses, but it currently accepts a constant negative offset produced by pointer arithmetic.
Commit 022ac0750883 ("bpf: use reg->var_off instead of reg->off for pointers") moved constant pointer offsets from reg->off to reg->var_off. However, __check_buffer_access() continued to check only the instruction offset. An access with reg->var_off equal to -8 and an instruction offset of zero therefore passes verification.
For writable raw tracepoints, the access end is also calculated from the unsigned reg->var_off.value. An eight-byte access starting at -8 wraps the calculated end to zero, allowing the program to load and attach without increasing max_tp_access.
After ensuring that reg->var_off is constant, calculate the effective access start using signed arithmetic and reject it when it is negative. Use the validated start to calculate the access end for both PTR_TO_TP_BUFFER and PTR_TO_BUF.
Which versions are affected by CVE-2026-68462?
How do I fix CVE-2026-68462?
Apply the vendor's patch.
Is CVE-2026-68462 being exploited?
There is no known exploitation of CVE-2026-68462 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-68462, GHSA-r48x-xhw6-jmg8, UBUNTU-CVE-2026-68462.