{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "022ac075088366b62e130da5e1b200bc93a47191"
            },
            {
              "fixed": "314bd592085c0720ef519f6edbc5f41440ff78d4"
            },
            {
              "fixed": "fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.1.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68462.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Reject negative const offsets for buffer pointers\n\nThe verifier rejects variable offsets for PTR_TO_TP_BUFFER and PTR_TO_BUF\naccesses, but it currently accepts a constant negative offset produced by\npointer arithmetic.\n\nCommit 022ac0750883 (\"bpf: use reg-\u003evar_off instead of reg-\u003eoff for\npointers\") moved constant pointer offsets from reg-\u003eoff to reg-\u003evar_off.\nHowever, __check_buffer_access() continued to check only the instruction\noffset. An access with reg-\u003evar_off equal to -8 and an instruction offset\nof zero therefore passes verification.\n\nFor writable raw tracepoints, the access end is also calculated from the\nunsigned reg-\u003evar_off.value. An eight-byte access starting at -8 wraps\nthe calculated end to zero, allowing the program to load and attach\nwithout increasing max_tp_access.\n\nAfter ensuring that reg-\u003evar_off is constant, calculate the effective\naccess start using signed arithmetic and reject it when it is negative.\nUse the validated start to calculate the access end for both\nPTR_TO_TP_BUFFER and PTR_TO_BUF.",
  "id": "CVE-2026-68462",
  "modified": "2026-08-16T03:30:56.221647880Z",
  "published": "2026-08-15T05:51:21.948Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/314bd592085c0720ef519f6edbc5f41440ff78d4"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fd4cfa8c8f9a17cdec0539334d28754bc1d8a5d9"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68462.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68462"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "bpf: Reject negative const offsets for buffer pointers"
}