PT-2026-65223 · Linux · Linux
CVE-2026-64548
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf msg push data()
When the scatterlist ring is full or nearly full, bpf msg push data()
enters a copy fallback path and computes copy + len for the page
allocation size. Since len comes from BPF with arg3 type = ARG ANYTHING
and both are u32, a crafted len can wrap the sum to a small value,
causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
Call Trace:
asan memcpy (mm/kasan/shadow.c:105)
bpf msg push data (net/core/filter.c:2852 net/core/filter.c:2788)
bpf prog 9ed8b5711920a7d7+0x2e/0x36
sk psock msg verdict (net/core/skmsg.c:934)
tcp bpf sendmsg (net/ipv4/tcp bpf.c:421 net/ipv4/tcp bpf.c:584)
sys sendto (net/socket.c:2206)
do syscall 64 (arch/x86/entry/syscall 64.c:94)
entry SYSCALL 64 after hwframe (arch/x86/entry/entry 64.S:130)
Add an overflow check before the allocation.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux