CVE-2026-74256

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check

start and len are u32, so

u64 last = start + len;

evaluates start + len in 32-bit and wraps before storing it in last.

The bounds check

if (start >= offset + l || last > msg->sg.size)

return -EINVAL;

can then be passed with an out-of-range start/len, after which the pop

loop runs off the end of the scatterlist and sk_msg_shift_left() calls

put_page() on the empty msg->sg.end slot:

Oops: general protection fault, probably for non-canonical address

0xdffffc0000000001: 0000 [#1] SMP KASAN PTI

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]

RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]

RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]

RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984

Call Trace:

<TASK>

bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8

bpf_prog_run_pin_on

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References