CVE-2026-68462

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The BPF verifier incorrectly accepts constant negative offsets produced by pointer arithmetic for PTR TO TP BUFFER and PTR TO BUF accesses. While variable offsets are rejected, the check buffer access() function only validates the instruction offset, ignoring the constant pointer offset stored in reg->var off. This allows an access with a negative reg->var off and a zero instruction offset to pass verification. In the case of writable raw tracepoints, using an unsigned reg->var off.value can cause the calculated access end to wrap to zero, enabling a program to load and attach without increasing max tp access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.