Executive brief
A vulnerability was identified in the Linux kernel's networking component that handles socket data. An error in how the system manages memory fragments when inserting data could lead to system instability or crashes. This affects systems using BPF (Berkeley Packet Filter) for advanced network traffic management.
Technical details
A vulnerability in bpf_msg_push_data() within the Linux kernel's sockmap implementation occurs when inserting data into the middle of a scatterlist (SG) entry. The function incorrectly calculates the offset for the resulting 'right' fragment by using a message-global insertion point instead of a fragment-local delta. This logic error results in an over-advanced offset for non-first SG entries, leading to an inconsistent memory layout. An attacker with the ability to execute BPF programs could potentially trigger this to cause a denial of service (system crash). The issue has been patched across multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.20 to 6.13
Timeline
- 2026-05-27: other: Vulnerability fix authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/3075c21d2d76c0067f4a382765b43d6cc10470f1
- https://git.kernel.org/stable/c/5e19028667963fb371ebb00cecc2a473ef92056b
- https://git.kernel.org/stable/c/63f64a510c7917658ddf4d073ece73914ee25346
- https://git.kernel.org/stable/c/96b72672ce849a1402730238e64d9b20bf06a96d
- https://git.kernel.org/stable/c/aeb95146848d12206e1b2cfacd4f40e21ce81d94
- https://git.kernel.org/stable/c/d81b323af2dcee47573907ccb89c0df9b45cb2e2
- https://git.kernel.org/stable/c/f14609d8146707452e0822f3c8154674ce677251