Linux Kernel CVE-2026-45838

The vulnerability resides in the BPF (Berkeley Packet Filter) cgroup storage map implementation within the Linux kernel, specifically the cgroup_storage_get_next_key() function used to iterate BPF map entries via the bpf_map_get_next_key() syscall. The root cause (CWE-476, Null Pointer Dereference, though the mechanism is more precisely a list-traversal logic error) is that list_next_entry() uses container_of() internally and never returns NULL; when the current element is the last in a linked list, it wraps around to the embedded list head structure rather than signaling termination. The subsequent NULL check is therefore permanently dead code. On the final map entry, the function dereferences a pointer that actually overlaps internal kernel map fields (the list head embedded in the map structure), reads storage->key from this invalid memory region, and copies the data to userspace. The fix replaces the NULL check with list_entry_is_head(), which correctly detects list termination. CPE data confirms the affected product as cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* across multiple stable release branches, all sharing the introducing commit de9cbbaadba5adf88a19e46df61f7054000838f6.