Linux kernel BPF cgroup storage: bogus pointer read and key copied to userspace at end of list

Impact

list_next_entry() wraps to the list head instead of returning NULL, so the dead NULL check meant to end iteration never fires. Walking a cgroup storage map to its last element makes the kernel read storage->key from a pointer that aliases internal map fields and copy that result out to userspace. In practice this exposes a few bytes of kernel map internals to whoever can iterate the map, and can corrupt the iteration itself. On a GPU fleet the realistic reacher is the node's CNI or observability stack (Cilium-style BPF cgroup maps) rather than a tenant pod, so treat it as a hardening fix unless tenants are granted BPF.

Who can reach it

Local, requires the ability to call BPF_MAP_GET_NEXT_KEY on a cgroup storage map - normally CAP_BPF/CAP_SYS_ADMIN, i.e. a privileged node agent or a container granted those capabilities. Not remotely reachable.

What to do

Take the fixed stable kernel (five stable commits linked, the fix switches to list_entry_is_head()) and reboot the node on the next kernel pass. No runtime mitigation other than not handing CAP_BPF to tenant workloads.

References

Related entries

• Linux kernel SUNRPC auth_gss: kernel memory leaks on GSS-proxy XDR decode error pathsCVE-2026-45870 · Linux kernel SUNRPC auth_gss (gssx_dec_ctx / gssx_dec_status / gssx_dec_name XDR decode)Medium
• Linux kernel (drivers/pci): A failed mmap of peer-to-peer DMA memory leaks the pgmap reference it took, and the leak isCVE-2026-45880 · Linux kernel (drivers/pci)Medium
• Linux kernel BPF: wrong bpf_xdp_store_bytes argument type lets the helper read uninitialized memoryCVE-2026-45886 · Linux kernel BPF (bpf_xdp_store_bytes helper argument type)Medium
• Linux kernel RT scheduler: self-IPI storm in rto_next_cpu() can hard-lock a CPUCVE-2026-45919 · Linux kernel sched/rt (rto_next_cpu() RT push-IPI loop)Medium
• Linux kernel SUNRPC auth_gss: gss_auth reference leaked when gss_alloc_msg allocation failsCVE-2026-45964 · Linux kernel SUNRPC auth_gss (gss_alloc_msg kref leak on kstrdup_const failure)Medium
• Linux kernel KVM nSVM: interrupt shadow not synced to cached vmcb12, nested vCPU can hangCVE-2026-45987 · Linux kernel KVM nSVM (vmcb12 interrupt shadow sync)Medium