PT-2026-61146 · Linux · Linux Kernel

CVE-2026-63830 · Published 2026-07-19 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A desynchronization issue exists in the sk msg sg.copy bitmap, which tracks scatterlist entry ownership. The sg.copy bit prevents sk msg compute data pointers() from exposing certain entries as writable BPF ctx->data, protecting pages not private to the sk msg, such as splice-backed file page-cache pages. Certain transform paths move, copy, split, or compact msg->sg.data[] entries without updating the corresponding sg.copy bit. This can result in an externally backed entry being assigned to a slot with a clear copy bit, allowing BPF stores to modify the original page cache via writable ctx->data during an SK MSG verdict.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-63830

Affected Products

Linux Kernel

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-63830 · Security Note
• https://git.kernel.org/stable/c/d22cc92bc41290e5783a72375e0843d9435f6001 · Note
• https://git.kernel.org/stable/c/9bb86d8184b37503816150c4a6ad3c17dfdbe827 · Note
• https://twitter.com/windowsforum/status/2079129990910689509 · Twitter Post
• https://git.kernel.org/stable/c/0eb4c16c4adb262763bda870a8ed38a1a9dec7ec · Note
• https://git.kernel.org/stable/c/1acdd14c0990dd1cd4b6534f00366d2e6dfce05f · Note
• https://git.kernel.org/stable/c/406e8a651a7b854c41fecd5117bb282b3a6c2c6b · Note
• https://git.kernel.org/stable/c/21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d · Note
• https://twitter.com/VulmonFeeds/status/2078851051780719059 · Twitter Post