CVE-2026-45683 LOW

CVE-2026-45683: OpenTelemetry eBPF Instrumentation: Java TLS ioctl kprobe allows kernel memory disclosure

Vendor Open-Telemetry
Product opentelemetry-ebpf-instrumentation
Weakness CWE-127
Published June 2, 2026
Last update June 2, 2026
View on NVD All CVEs

CVSS base score

3.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

Description

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpf_probe_read instead of bpf_probe_read_user. An instrumented local process can therefore point OBI at kernel memory and cause that memory to be copied into telemetry. This issue has been patched in version 0.9.0.

Key dates

Disclosure timeline

June 2, 2026 CVE published
June 2, 2026 Record updated