Junglewise Threat Intelligence

CVE-2026-45838: Linux Kernel BPF information leak in cgroup_storage_get_next_key

CVE-2026-45838 · Severity: info · CVSS 4.4 · Published 2026-05-27

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's BPF subsystem, which handles specialized programs used for networking and security. A flaw in how the system tracks data lists could allow a local user to read unintended internal memory information. This could potentially lead to the exposure of sensitive system data or cause minor stability issues.

Technical details

A vulnerability exists in the Linux kernel BPF subsystem within the `cgroup_storage_get_next_key()` function in `kernel/bpf/local_storage.c`. The function uses `list_next_entry()`, which wraps back to the list head instead of returning NULL when reaching the end of a list. Because the subsequent NULL check is ineffective, the function fails to return the expected -ENOENT error at the end of the list. Instead, it proceeds to read from a bogus pointer that aliases internal map fields and copies this data to userspace. This is a local information leak and out-of-bounds read. The issue has been patched by replacing the NULL check with `list_entry_is_head()`.

Affected products

  • Linux Linux Kernel Introduced in de9cbbaadba5; fixed in 5.10.218, 5.15.160, 6.1.92, 6.6.32, 6.9.3

Timeline

  • 2026-04-03: disclosed: Initial patch submitted by Weiming Shi
  • 2026-05-23: patched: Patches committed to various stable branches
  • 2026-05-27: advisory: CVE-2026-45838 published

References