Linux Kernel CVE-2026-68462

The vulnerability resides in the Linux kernel's extended BPF (eBPF) verifier, specifically within __check_buffer_access(), which is responsible for validating memory accesses on PTR_TO_TP_BUFFER (writable raw tracepoint buffer pointers) and PTR_TO_BUF (generic BPF buffer pointers). Commit 022ac0750883 ('bpf: use reg->var_off instead of reg->off for pointers') restructured how the verifier tracks constant pointer offsets, moving them from the reg->off field to reg->var_off. However, __check_buffer_access() was not updated to account for this change and continued evaluating only the instruction-level offset. As a result, a BPF program that uses pointer arithmetic to set reg->var_off to a negative constant (e.g., -8) with an instruction offset of zero passes verification entirely, because the checked value is zero - well within bounds. A secondary compounding flaw affects writable raw tracepoints specifically: the access end address is computed using the unsigned interpretation of reg->var_off.value, so an 8-byte access starting at -8 wraps the computed end address to zero, allowing the program to load and attach without incrementing the max_tp_access guard that enforces the upper memory boundary. The affected kernel versions span from the introduction of commit 022ac0750883 through the fix commits on each stable branch. The CWE classification is not provided in source data, but the root cause maps to improper signed/unsigned handling in security-critical verifier arithmetic - analogous to CWE-195 (Signed to Unsigned Conversion Error) or CWE-125 (Out-of-bounds Read).