CVE-2026-64548 in Linux
Summary
by MITRE • 07/28/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI
Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability exists in the linux kernel's bpf subsystem particularly within the sockmap functionality where bpf_msg_push_data() handles data copying operations. The flaw occurs when the scatterlist ring reaches capacity or near capacity conditions, triggering a copy fallback mechanism that computes memory allocation size using the formula copy + len. The issue stems from the fact that len parameter originates from bpf programs with arg3_type = ARG_ANYTHING which allows arbitrary values to be passed as u32 integers. When crafted malicious values are provided for len, they can cause integer overflow during the sum computation resulting in an undersized memory allocation that subsequently leads to out-of-bounds memcpy operations.
The technical implementation details reveal that this vulnerability operates through a classic integer overflow scenario where the addition of copy and len parameters wraps around due to u32 arithmetic limitations. This overflow results in a significantly smaller allocation size than required, creating a buffer underflow condition that allows subsequent memory access violations. The call trace demonstrates the execution path leading to the vulnerability through kernel memory management functions including __asan_memcpy for memory copying operations, bpf_msg_push_data for the problematic function, and the complete chain ending with tcp_bpf_sendmsg and system call processing.
The operational impact of this vulnerability spans across multiple attack vectors within the linux networking stack. An attacker could potentially exploit this through crafted bpf programs that manipulate socket messages to cause kernel memory corruption, leading to denial of service conditions or potential privilege escalation depending on the exploitation context. The vulnerability directly affects systems utilizing bpf sockmap functionality for network packet processing, particularly those implementing socket-based message queuing and tcp_bpf operations. This represents a critical security flaw that could be leveraged by malicious actors to compromise kernel memory integrity.
The fix implemented addresses this by adding explicit overflow checks before memory allocation occurs in the bpf_msg_push_data() function. This approach follows established security practices for preventing integer overflows in memory management operations and aligns with common vulnerability remediation techniques outlined in various security standards. The solution prevents the computation of invalid memory allocation sizes by validating input parameters before they are used in arithmetic operations, thereby eliminating the possibility of integer wraparound scenarios that lead to buffer underflows.
This vulnerability type maps directly to CWE-190 which describes integer overflow and underflow conditions, specifically addressing the scenario where arithmetic operations produce results that exceed the range representable by the data type. The attack pattern aligns with ATT&CK technique T1059.007 for executing malicious code through kernel modules and could potentially map to privilege escalation techniques within the T1068 category. The vulnerability also reflects common issues found in kernel memory management subsystems that are frequently targeted by advanced persistent threats due to their privileged execution context and direct access to system resources.