PT-2026-64574 · Linux · Linux
CVE-2026-64353
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Keep dynamic inner array lookups nullable
An ARRAY OF MAPS can use an array created with BPF F INNER MAP as its
inner map template. A concrete inner array with a different max entries
value can then replace the template.
After a successful outer map lookup, the verifier represents the
resulting map pointer using the inner map template. Const-key lookup
nullness elision consequently uses the template max entries even though
the runtime helper uses the concrete inner map max entries.
Do not elide lookup result nullness for maps marked with BPF F INNER MAP,
because the template max entries does not prove that the key is in bounds
for the concrete runtime map.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux