CVE-2026-68462

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The bug is in bpf_check() during bpf(BPF_PROG_LOAD); the path is bpf_prog_load() → bpf_check() → check_mem_access() → __check_buffer_access() on PTR_TO_TP_BUFFER/PTR_TO_BUF. Per kernel CNA guidance BPF verifier bugs are Local, not network-reachable.

AC:LAttack complexity, low

Exploitation is deterministic: pointer arithmetic (e.g. r6 += -8) yields a constant negative reg->var_off that passes the insn-only check, and unsigned wrap sets max_tp_access/max_rdwr_access to zero. The attacker fully controls program bytecode and triggering with no race or layout dependency.

PR:LPrivileges required, low

Affected BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE and BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER programs require CAP_BPF and CAP_PERFMON checked by bpf_token_capable(); BPF tokens delegate these capabilities into a non-init user namespace, so a namespace-local actor can reach bpf_prog_load without init-namespace root.

UI:NUser interaction, none

No victim interaction is required; after loading and attaching the malicious program the attacker triggers execution by reading a BPF iterator fd or causing a writable raw tracepoint to fire, entirely through their own syscalls.

S:UScope, unchanged

The verifier bypass permits out-of-bounds kernel reads/writes adjacent to tracepoint or iterator buffers within the same host kernel security authority; impact is standard kernel memory corruption and privilege escalation, not a VM, container, or IOMMU boundary crossing.

C:HConfidentiality impact, high

Verified loads at negative offsets read up to eight bytes before PTR_TO_TP_BUFFER or PTR_TO_BUF targets, disclosing adjacent kernel stack or kmalloc memory (map keys/values, tracepoint writable buffers); per guidance out-of-bounds kernel reads warrant High confidentiality impact.

I:HIntegrity impact, high

Writable raw tracepoint programs can store at negative offsets while max_tp_access wraps to zero, and PTR_TO_BUF iterator contexts allow verified writes before map value buffers; these out-of-bounds stores corrupt adjacent kernel memory with a plausible control-flow hijack primitive.

A:HAvailability impact, high

Out-of-bounds kernel memory accesses from attached BPF programs commonly provoke kernel oops or panic; the attacker can repeatedly trigger iterator reads or writable raw tracepoints to deny host availability.