CVE-2026-64548

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

When the scatterlist ring is full or nearly full, bpf_msg_push_data()

enters a copy fallback path and computes copy + len for the page

allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING

and both are u32, a crafted len can wrap the sum to a small value,

causing an undersized allocation followed by an out-of-bounds memcpy.

BUG: unable to handle page fault for address: ffffed104089a402

Oops: Oops: 0000 [#1] SMP KASAN NOPTI

Call Trace:

__asan_memcpy (mm/kasan/shadow.c:105)

bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788)

bpf_prog_9ed8b5711920a7d7+0x2e/0x36

sk_psock_msg_verdict (net/core/skmsg.c:934)

tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584)

__sys_sendto (net/socket.c:2206)

do_syscall_64 (arch/x86/entry/syscall_64.c:94)

entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References