CVE-2026-45838
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix end-of-list detection in cgroup_storage_get_next_key() list_next_entry() never returns NULL -- when the current element is the last entry it wraps to the list head via container_of(). The subsequent NULL check is therefore dead code and get_next_key() never returns -ENOENT for the last element, instead reading storage->key from a bogus pointer that aliases internal map fields and copying the result to userspace. Replace it with list_entry_is_head() so the function correctly returns -ENOENT when there are no more entries.
How to fix
- linux linux_kernel5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10 or later
- git.kernel.org/stable/c/0f3d9dd5e1fd52b39e25328307c6a694e994ffe3
- git.kernel.org/stable/c/26d3339e465e54107bd85884341d1609c5300d6a
- git.kernel.org/stable/c/2c88b2d96e1d4d0c7c4589a4593d4cdee6d332d6
- git.kernel.org/stable/c/32ce55d424395904986f5066f8755f6cb9993377
- git.kernel.org/stable/c/5828b9e5b272ecff7cf5d345128d3de7324117f7
- git.kernel.org/stable/c/85a2f30e40f7468db732f55659bc6318874f49af
- git.kernel.org/stable/c/b4b5a20bed82130da2f2818f04d52378952fbd0b
- git.kernel.org/stable/c/fc39753b7f92e09177777e9c648afe5aa3abb81f
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.19 ≤ v < 5.10.258, 5.11 ≤ v < 5.15.209, 5.16 ≤ v < 6.1.175, 6.2 ≤ v < 6.6.141, 6.7 ≤ v < 6.12.91, 6.13 ≤ v < 6.18.33, 6.19 ≤ v < 7.0.10 | 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.