CVE-2026-68187

Received Received - Intake

Integer Underflow in Linux Kernel exec Stack Handling

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: exec: fix unsigned loop counter wrap in transfer_args_to_stack() The stop value is derived from bprm->p >> PAGE_SHIFT. The index variable is an unsigned long. If bprm->p drops below PAGE_SIZE and stop becomes zero the loop condition index >= stop is always true. After the index == 0 iteration the decrement wraps to ULONG_MAX and bprm->page[ULONG_MAX] reads sizeof(void *) bytes in front of the array. The pointer has wrapped to -1. That garbage pointer is then passed to kmap_local_page() and PAGE_SIZE bytes are copied from wherever that lands into the stack of the process being created. And the loop doesn't terminate either... Getting there only requires bprm->p < PAGE_SIZE. On !MMU bprm_set_stack_limit() and bprm_hit_stack_limit() are empty. So the only constraint on how far bprm->p is pushed down is valid_arg_len(), i.e. that each individual string still fits in what is left. bprm->p starts at PAGE_SIZE * MAX_ARG_PAGES - sizeof(void *) so a single argument or environment string of a little over 31 pages leaves it in the first page: Oops - load access fault [#1] CPU: 0 UID: 0 PID: 1 Comm: victim Not tainted 7.2.0-rc4 #1 epc : __memcpy+0xd4/0xf8 ra : transfer_args_to_stack+0xaa/0xae s4 : ffffffffffffffff s2 : 0000000000000000 a1 : ffffffdc98000000 a2 : 0000000000001000 status: 0000000a00001880 badaddr: ffffffdc98000000 cause: 0000000000000005 [<801a5324>] __memcpy+0xd4/0xf8 [<800d5f6a>] load_flat_binary+0x43a/0x65e [<800a2de4>] bprm_execve+0x1d4/0x316 [<800a351a>] do_execveat_common+0x12e/0x138 [<800a3d44>] __riscv_sys_execve+0x38/0x4e Kernel panic - not syncing: Fatal exception in interrupt This is an arcane bug but we should still fix it. Count down from MAX_ARG_PAGES so the loop ends when index reaches stop, stop == 0 included. The iterations performed are unchanged for every other value of stop. Only CONFIG_MMU=n builds are affected, transfer_args_to_stack() is used by binfmt_flat and binfmt_elf_fdpic on nommu only. The loop predates git history. commit 7e7ec6a93434 ("elf_fdpic_transfer_args_to_stack(): make it generic") only moved it from binfmt_elf_fdpic.c into fs/exec.c and narrowed the copy to the used part of the first page. The condition and the decrement are unchanged from 2.6.12-rc2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-31

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68187

EUVD

EUVD-2026-55288

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.2.0-rc4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves an unsigned loop counter wrap in the transfer_args_to_stack() function. When bprm->p drops below PAGE_SIZE, the loop condition becomes always true, causing the index to wrap to ULONG_MAX. This leads to reading out-of-bounds memory, copying garbage data into the process stack, and potential kernel panic due to invalid memory access.

Detection Guidance

This vulnerability affects only Linux kernels without MMU support (CONFIG_MMU=n) and involves a loop counter wrap in the exec subsystem. Detection requires checking kernel configuration and logs for crashes during process execution with large argument/environment strings.

Impact Analysis

This vulnerability can cause a kernel panic, leading to system crashes. It may allow local attackers to execute arbitrary code with kernel privileges or cause denial-of-service conditions. Systems using nommu configurations (CONFIG_MMU=n) are specifically affected.

Compliance Impact

This vulnerability is a kernel memory corruption issue in the Linux operating system. It does not directly relate to data protection standards like GDPR or HIPAA, which focus on unauthorized data access or disclosure. The impact is limited to system stability and potential denial-of-service conditions on affected systems.

Mitigation Strategies

Apply the Linux kernel patch fixing the loop counter issue in transfer_args_to_stack(). For systems without MMU support, ensure the kernel is updated to a patched version. Monitor for crashes during process execution as a potential indicator of exploitation.

Hi! I’m here to help you understand CVE-2026-68187. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70