CVE-2026-68187

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc4

Description An unsigned loop counter wrap exists in the transfer args to stack() function. When the bprm->p value drops below PAGE SIZE, the stop value becomes zero, causing the loop condition index >= stop to remain true indefinitely. After the initial iteration where index is zero, the decrement operation causes the counter to wrap to ULONG MAX. This leads to an out-of-bounds read from the bprm->page array, where a garbage pointer is passed to the kmap local page() function. Consequently, PAGE SIZE bytes are copied from an arbitrary memory location into the stack of the process being created, potentially leading to a kernel panic. This issue specifically affects builds with CONFIG MMU=n where transfer args to stack() is utilized by binfmt flat and binfmt elf fdpic on systems without a Memory Management Unit (MMU).

Recommendations Update the Linux kernel to version 7.2.0-rc4 or later. As a temporary mitigation, restrict the use of binfmt flat and binfmt elf fdpic on affected non-MMU builds.