CVE-2026-68187: exec: fix unsigned loop counter wrap in transfer_args_to_stack()

In the Linux kernel, the following vulnerability has been resolved:

exec: fix unsigned loop counter wrap in transferargstostack()

The stop value is derived from bprm->p >> PAGESHIFT. The index variable is an unsigned long. If bprm->p drops below PAGESIZE and stop becomes zero the loop condition index >= stop is always true.

After the index == 0 iteration the decrement wraps to ULONGMAX and bprm->page[ULONGMAX] reads sizeof(void ) bytes in front of the array. The pointer has wrapped to -1. That garbage pointer is then passed to kmaplocalpage() and PAGESIZE bytes are copied from wherever that lands into the stack of the process being created. And the loop doesn't terminate either...

Getting there only requires bprm->p < PAGESIZE. On !MMU bprmsetstacklimit() and bprmhitstacklimit() are empty. So the only constraint on how far bprm->p is pushed down is validarglen(), i.e. that each individual string still fits in what is left.

bprm->p starts at PAGESIZE MAXARGPAGES - sizeof(void ) so a single argument or environment string of a little over 31 pages leaves it in the first page:

Oops - load access fault [#1] CPU: 0 UID: 0 PID: 1 Comm: victim Not tainted 7.2.0-rc4 #1 epc : memcpy+0xd4/0xf8 ra : transferargstostack+0xaa/0xae s4 : ffffffffffffffff s2 : 0000000000000000 a1 : ffffffdc98000000 a2 : 0000000000001000 status: 0000000a00001880 badaddr: ffffffdc98000000 cause: 0000000000000005 [<801a5324>] memcpy+0xd4/0xf8 [<800d5f6a>] loadflatbinary+0x43a/0x65e [<800a2de4>] bprmexecve+0x1d4/0x316 [<800a351a>] doexecveatcommon+0x12e/0x138 [<800a3d44>] riscvsysexecve+0x38/0x4e Kernel panic - not syncing: Fatal exception in interrupt

This is an arcane bug but we should still fix it.

Count down from MAXARGPAGES so the loop ends when index reaches stop, stop == 0 included. The iterations performed are unchanged for every other value of stop.

Only CONFIGMMU=n builds are affected, transferargstostack() is used by binfmtflat and binfmtelffdpic on nommu only.

The loop predates git history. commit 7e7ec6a93434 ("elffdpictransferargstostack(): make it generic") only moved it from binfmtelffdpic.c into fs/exec.c and narrowed the copy to the used part of the first page. The condition and the decrement are unchanged from 2.6.12-rc2.