5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45681

CVE-2026-45681: OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the per-CPU message-buffer fallback path uses a 256-byte backup buffer but preserves the original payload size, which can be up to 8KB. If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry. This issue has been patched in version 0.9.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45681

CVE-2026-45681:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.opentelemetry.io/obi	go	< 0.9.0	0.9.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the handling of a fallback mechanism within the eBPF-based tracing functions of OpenTelemetry. Specifically, when a CPU mismatch is detected between the context that writes to a per-CPU buffer and the one that reads from it, the code switches to a fixed-size 256-byte fallback buffer. However, the logic for determining the size of the data to be read from this buffer did not account for this switch. It continued to use the original data size (real_size), which could be as large as 8KB. This discrepancy between the buffer size (256 bytes) and the read size (up to 8KB) creates an out-of-bounds read vulnerability, potentially leaking sensitive kernel memory into the telemetry data.

The analysis of the provided patch commit 5d375cbc8d5f5187c5f8bf78e4f78265c0a262d5 clearly shows the vulnerable code and the subsequent fix. The changes are located in the bpf/generictracer/k_tracer.c file, within the obi_kprobe_tcp_sendmsg and obi_kprobe_tcp_rate_check_app_limited functions. In both functions, the patch introduces a conditional check (use_fallback) and uses the min() macro to clamp the read size to k_kprobes_http2_buf_size (the size of the fallback buffer) when the fallback path is taken. This directly addresses the root cause of the vulnerability. Therefore, these two functions are identified as the vulnerable functions that would be active during the exploitation of this vulnerability.

Vulnerable functions

obi_kprobe_tcp_sendmsg

bpf/generictracer/k_tracer.c

When a CPU mismatch occurs, the code uses a 256-byte fallback buffer but was previously using the original 'real_size' (up to 8KB) to determine the amount of data to read. This mismatch could lead to an out-of-bounds read, leaking adjacent memory. The patch corrects this by clamping the read size to the size of the fallback buffer when it's in use.

obi_kprobe_tcp_rate_check_app_limited

bpf/generictracer/k_tracer.c

Similar to 'obi_kprobe_tcp_sendmsg', this function also handles a fallback buffer path in case of a CPU mismatch. It was vulnerable to an out-of-bounds read because it used the larger 'real_size' with the smaller fallback buffer. The fix applies the same clamping logic, ensuring the read size does not exceed the fallback buffer's capacity.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.