CVE-2026-64548

bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

State: Published
Severity: 8.4 High
Published: Jul 27, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy.

BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

Add an overflow check before the allocation.

Scores

CVSS	Score	Vector	Source
3.1	8.4 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
LinuxLinux	6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before a12b1575f9feabd91695a9e9d004862f7195fa25Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before ff39d0e3b4feeb65ca43c453d7c75fdf872ded0dAffected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 888706a76286c547bd035432602571e8024b5305Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before db77b6bb6e6edb79b10b4efcce346eec5582d588Affected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 4e40056bb5c829f0423f0a6694a0477726d2147eAffected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before bd004716ba75fed6d185795c85cdc92540ebeaabAffected 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 0c0a8ed85349dae298712d79cb276acfeb794d82Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before a12b1575f9feabd91695a9e9d004862f7195fa25Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before ff39d0e3b4feeb65ca43c453d7c75fdf872ded0dAffected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 888706a76286c547bd035432602571e8024b5305Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before db77b6bb6e6edb79b10b4efcce346eec5582d588Affected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 4e40056bb5c829f0423f0a6694a0477726d2147eAffected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before bd004716ba75fed6d185795c85cdc92540ebeaabAffected
6fff607e2f14bd7c63c06c464a6f93b8efbabe28 to before 0c0a8ed85349dae298712d79cb276acfeb794d82Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.