CVE-2026-63830 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: skmsg: preserve sg.copy across SG transforms
The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages.
Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can
make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache.
Keep sg.copy synchronized with sg.data[] whenever entries are
transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the linux kernel's socket message handling subsystem where the scatter-gather list copy bit mapping becomes inconsistent during message transformation operations. The issue stems from how the sk_msg structure manages ownership state through the sg.copy bitmap which indicates whether scatter-gather entries are backed by private pages or shared page cache entries. When message transformations occur without properly synchronizing the copy bit with the actual data movement, it creates a security exposure where externally backed pages can be incorrectly marked as writable through BPF context pointers.
The technical flaw manifests when various sk_msg transformation functions such as sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record() manipulate scatter-gather entries without maintaining proper synchronization between the sg.data[] array entries and their corresponding sg.copy bitmap bits. This inconsistency allows a clear copy bit to remain set on an entry that has been moved from its original location, even though the underlying page may have been shared with the file system's page cache. The vulnerability specifically affects BPF operations that utilize the SK_MSG verdict mechanism, where the modified sg.copy bit can cause sg_virt() to expose the original page cache entry as writable through ctx->data pointers.
The operational impact of this vulnerability is significant as it enables arbitrary modification of shared page cache entries through BPF programs. When a BPF program executes with SK_MSG verdict and accesses ctx->data, it can inadvertently write to pages that are not private to the socket message structure, potentially corrupting file system data or enabling privilege escalation attacks. This affects any system running kernel versions where the sk_msg transformation paths do not properly maintain copy bit synchronization during data movement operations.
The vulnerability aligns with CWE-121 and CWE-125 categories related to buffer overflow conditions and out-of-bounds reads, while also mapping to ATT&CK techniques involving privilege escalation through kernel exploitation. The fix requires maintaining strict synchronization between scatter-gather data entries and their copy bit states throughout all transformation paths, ensuring that when entries are moved, copied, or split, the corresponding bits are properly updated. Additionally, the solution must clear copy bits when entries are replaced with newly allocated private pages or freed, covering all BPF helper operations including pull/push/pop functions and TLS record handling mechanisms.
Security mitigations include updating to kernel versions that implement proper sg.copy bit synchronization during all sk_msg transformation paths, implementing additional validation checks in BPF programs accessing socket message data, and monitoring for unexpected modifications to shared page cache entries. Organizations should prioritize kernel updates and consider implementing runtime protections that can detect anomalous BPF program behavior involving socket message transformations. The fix specifically addresses the root cause by ensuring that copy bit operations are consistently maintained during all message transfer, shifting, splitting, and copying operations within the sk_msg subsystem.
This vulnerability represents a critical kernel-level security flaw that demonstrates the importance of maintaining data structure consistency in operating system internals. The issue highlights how seemingly minor inconsistencies in memory management state tracking can lead to severe security implications when combined with BPF's powerful network processing capabilities. Proper synchronization between data ownership indicators and actual data locations is essential for preventing unauthorized access to shared resources, particularly in kernel subsystems that handle network communication and BPF program execution where the attack surface extends beyond traditional privilege boundaries.