CVE-2026-64548
Description
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Add an overflow check before the allocation.
How to fix
- Linux Linuxf1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5, a12b1575f9feabd91695a9e9d004862f7195fa25, ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d, 888706a76286c547bd035432602571e8024b5305, db77b6bb6e6edb79b10b4efcce346eec5582d588, 4e40056bb5c829f0423f0a6694a0477726d2147e, bd004716ba75fed6d185795c85cdc92540ebeaab, 0c0a8ed85349dae298712d79cb276acfeb794d82 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < a12b1575f9feabd91695a9e9d004862f7195fa25, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < 888706a76286c547bd035432602571e8024b5305, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < db77b6bb6e6edb79b10b4efcce346eec5582d588, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < 4e40056bb5c829f0423f0a6694a0477726d2147e, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < bd004716ba75fed6d185795c85cdc92540ebeaab, 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 ≤ v < 0c0a8ed85349dae298712d79cb276acfeb794d82, 4.20 | f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5, a12b1575f9feabd91695a9e9d004862f7195fa25, ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d, 888706a76286c547bd035432602571e8024b5305, db77b6bb6e6edb79b10b4efcce346eec5582d588, 4e40056bb5c829f0423f0a6694a0477726d2147e, bd004716ba75fed6d185795c85cdc92540ebeaab, 0c0a8ed85349dae298712d79cb276acfeb794d82 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.