CVE-2026-45838 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer that aliases internal map fields and copying the result to userspace. Replace it with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries.
A vulnerability in the Linux kernel's handling of cgroup storage maps can lead to incorrect data being read and potentially exposed to userspace. This issue arises because the function responsible for retrieving keys from the storage map does not properly recognize when it has reached the end of the list. Instead of returning a 'no more entries' signal, it reads from a faulty pointer that overlaps with internal map fields, copying erroneous data to userspace. The vulnerability is present in the stable versions of the Linux kernel.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. The specific commit that resolves this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0f3d9dd5e1fd52b39e25328307c6a694e994ffe3 | kernel.org | Patch |
| https://git.kernel.org/stable/c/26d3339e465e54107bd85884341d1609c5300d6a | kernel.org | Patch |
| https://git.kernel.org/stable/c/2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6 | kernel.org | Patch |
| https://git.kernel.org/stable/c/32ce55d424395904986f5066f8755f6cb9993377 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5828b9e5b272ecff7cf5d345128d3de7324117f7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/85a2f30e40f7468db732f55659bc6318874f49af | kernel.org | Patch |
| https://git.kernel.org/stable/c/b4b5a20bed82130da2f2818f04d52378952fbd0b | kernel.org | Patch |
| https://git.kernel.org/stable/c/fc39753b7f92e09177777e9c648afe5aa3abb81f | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.19, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |