CVE-2026-45967

Analyzed Analyzed - Analysis Complete

BPF Instruction Array Offset Handling Bug in Linux Kernel

Publication date: 2026-05-27

Last updated on: 2026-06-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Return proper address for non-zero offsets in insn array The map_direct_value_addr() function of the instruction array map incorrectly adds offset to the resulting address. This is a bug, because later the resolve_pseudo_ldimm64() function adds the offset. Fix it. Corresponding selftests are added in a consequent commit.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-27

Last Modified

2026-06-16

Generated

2026-07-07

AI Q&A

2026-05-27

EPSS Evaluated

2026-07-05

NVD

CVE-2026-45967

EUVD

EUVD-2026-32251

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.19 (inc) to 6.19.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the instruction array map handling.

The function map_direct_value_addr() incorrectly adds an offset to the resulting address when the offset is non-zero. This is a bug because another function, resolve_pseudo_ldimm64(), also adds the offset later, causing an incorrect address calculation.

This issue has been fixed by correcting the address calculation and adding corresponding self-tests.

Impact Analysis

This vulnerability in the Linux kernel involves an incorrect address calculation in the bpf instruction array map, where the map_direct_value_addr() function adds an offset that should not be added, leading to potential incorrect memory addressing.

Such a bug could potentially cause unexpected behavior in programs using this part of the kernel, possibly leading to crashes or incorrect data handling.

Hi! I’m here to help you understand CVE-2026-45967. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70