Linux Kernel Vulnerability in BPF CO-RE Accessor Indices

CVE-2026-45839

What is CVE-2026-45839?

A vulnerability in the Linux kernel allows for the improper handling of negative CO-RE accessor indices within the BPF framework. Specifically, the function bpf_core_parse_spec() accepts negative values without rejection. This flaw can lead to out-of-bounds reads, causing kernel crashes when crafted BPF programs are executed. Systems with debug information enabled (CONFIG_DEBUG_INFO_BTF=y) are particularly at risk, as exploitation of this vulnerability results in page faults and unpredictable behavior. It's crucial for users to update their kernels to the latest versions where this issue has been addressed.

References