CVE-2026-63926

bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

State: Published
Severity: 8.4 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment.

The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent.

Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before f14609d8146707452e0822f3c8154674ce677251Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before d81b323af2dcee47573907ccb89c0df9b45cb2e2Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before aeb95146848d12206e1b2cfacd4f40e21ce81d94Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 96b72672ce849a1402730238e64d9b20bf06a96dAffected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 3075c21d2d76c0067f4a382765b43d6cc10470f1Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 5e19028667963fb371ebb00cecc2a473ef92056bAffected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 63f64a510c7917658ddf4d073ece73914ee25346Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before f72eed9b84fb771019a955908132410a9ba9ea3fAffected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before f14609d8146707452e0822f3c8154674ce677251Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before d81b323af2dcee47573907ccb89c0df9b45cb2e2Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before aeb95146848d12206e1b2cfacd4f40e21ce81d94Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 96b72672ce849a1402730238e64d9b20bf06a96dAffected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 3075c21d2d76c0067f4a382765b43d6cc10470f1Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 5e19028667963fb371ebb00cecc2a473ef92056bAffected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 63f64a510c7917658ddf4d073ece73914ee25346Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before f72eed9b84fb771019a955908132410a9ba9ea3fAffected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.