CVE-2026-64353

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Keep dynamic inner array lookups nullable

An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its

inner map template. A concrete inner array with a different max_entries

value can then replace the template.

After a successful outer map lookup, the verifier represents the

resulting map pointer using the inner map template. Const-key lookup

nullness elision consequently uses the template max_entries even though

the runtime helper uses the concrete inner map max_entries.

Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP,

because the template max_entries does not prove that the key is in bounds

for the concrete runtime map.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References