Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem that could allow a local attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system handles specific types of network socket data using BPF programs. This could lead to a complete system outage or unauthorized access to sensitive kernel memory.
Technical details
An integer overflow vulnerability exists in the Linux kernel's BPF subsystem, specifically within the bpf_msg_push_data() function used by sockmaps. When the scatterlist ring is nearly full, the function enters a fallback path that calculates a page allocation size by adding two u32 values (copy + len). Because the 'len' parameter is not properly validated (ARG_ANYTHING), a crafted value can cause the sum to wrap around, resulting in an undersized memory allocation. Subsequent memory copy operations (memcpy) then write data beyond the allocated buffer, leading to a kernel oops or potential local privilege escalation. The issue has been resolved by adding an explicit overflow check before allocation.
Affected products
- Linux Linux 6fff607e2f14bd7c63c06c464a6f93b8efbabe28
Timeline
- 2026-06-14: other: Committed to mainline kernel tree
- 2026-07-27: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/0c0a8ed85349dae298712d79cb276acfeb794d82
- https://git.kernel.org/stable/c/4e40056bb5c829f0423f0a6694a0477726d2147e
- https://git.kernel.org/stable/c/888706a76286c547bd035432602571e8024b5305
- https://git.kernel.org/stable/c/a12b1575f9feabd91695a9e9d004862f7195fa25
- https://git.kernel.org/stable/c/bd004716ba75fed6d185795c85cdc92540ebeaab
- https://git.kernel.org/stable/c/db77b6bb6e6edb79b10b4efcce346eec5582d588
- https://git.kernel.org/stable/c/f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5