In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel6.12-modules-extra-commonUpgrade bpftool-debuginfoUpgrade kernel6.12-tools-develUpgrade python3-perf6.12Upgrade kernel6.12Upgrade perf6.12Upgrade kernel-debuginfo-common-aarch64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel6.12-modules-extraUpgrade kernel6.12-headersUpgrade kernel-develUpgrade kernel-modules-extraUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade kernel6.12-develUpgrade perfUpgrade kernel-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-livepatch-6.1.180-225.360Upgrade bpftoolUpgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernelUpgrade kernel-toolsUpgrade bpftool6.12Upgrade kernel6.12-toolsUpgrade python3-perfUpgrade kernel-modules-extra-commonUpgrade kernel6.12-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-6.12.100-125.179Upgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perf6.12-debuginfo | Aug 18, 2026 | Jul 27, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linuxUpgrade linux-6.1 | Aug 2, 2026 | Aug 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 30, 2026 | Jul 27, 2026 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegraNo solution existsUpgrade linux-image-6.8.0-1035-nvidia-tegraUpgrade linux-image-6.8.0-1035-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-nvidia-tegra-rt-6.8 | Sep 21, 2026 | Sep 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 14, 2026 | Jul 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub