CVE-2026-45967
Analyzed Analyzed - Analysis Complete
BPF Instruction Array Offset Handling Bug in Linux Kernel

Publication date: 2026-05-27

Last updated on: 2026-06-16

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Return proper address for non-zero offsets in insn array The map_direct_value_addr() function of the instruction array map incorrectly adds offset to the resulting address. This is a bug, because later the resolve_pseudo_ldimm64() function adds the offset. Fix it. Corresponding selftests are added in a consequent commit.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-27
Last Modified
2026-06-16
Generated
2026-06-16
AI Q&A
2026-05-27
EPSS Evaluated
2026-06-15
NVD
CVE-2026-45967
EUVD
EUVD-2026-32251
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel From 6.19 (inc) to 6.19.4 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

This vulnerability in the Linux kernel involves an incorrect address calculation in the bpf instruction array map, where the map_direct_value_addr() function adds an offset that should not be added, leading to potential incorrect memory addressing.

Such a bug could potentially cause unexpected behavior in programs using this part of the kernel, possibly leading to crashes or incorrect data handling.

Executive Summary

This vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the instruction array map handling.

The function map_direct_value_addr() incorrectly adds an offset to the resulting address when the offset is non-zero. This is a bug because another function, resolve_pseudo_ldimm64(), also adds the offset later, causing an incorrect address calculation.

This issue has been fixed by correcting the address calculation and adding corresponding self-tests.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45967. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart