In the Linux kernel, the following vulnerability has been resolved:
bpf: fix ktls panic with sockmap
[ 2172.936997] ------------[ cut here ]------------ [ 2172.936999] kernel BUG at lib/iov_iter.c:629! ...... [ 2172.944996] PKRU: 55555554 [ 2172.945155] Call Trace: [ 2172.945299] <TASK> [ 2172.945428] ? die+0x36/0x90 [ 2172.945601] ? do_trap+0xdd/0x100 [ 2172.945795] ? iov_iter_revert+0x178/0x180 [ 2172.946031] ? iov_iter_revert+0x178/0x180 [ 2172.946267] ? do_error_trap+0x7d/0x110 [ 2172.946499] ? iov_iter_revert+0x178/0x180 [ 2172.946736] ? exc_invalid_op+0x50/0x70 [ 2172.946961] ? iov_iter_revert+0x178/0x180 [ 2172.947197] ? asm_exc_invalid_op+0x1a/0x20 [ 2172.947446] ? iov_iter_revert+0x178/0x180 [ 2172.947683] ? iov_iter_revert+0x5c/0x180 [ 2172.947913] tls_sw_sendmsg_locked.isra.0+0x794/0x840 [ 2172.948206] tls_sw_sendmsg+0x52/0x80 [ 2172.948420] ? inet_sendmsg+0x1f/0x70 [ 2172.948634] __sys_sendto+0x1cd/0x200 [ 2172.948848] ? find_held_lock+0x2b/0x80 [ 2172.949072] ? syscall_trace_enter+0x140/0x270 [ 2172.949330] ? __lock_release.isra.0+0x5e/0x170 [ 2172.949595] ? find_held_lock+0x2b/0x80 [ 2172.949817] ? syscall_trace_enter+0x140/0x270 [ 2172.950211] ? lockdep_hardirqs_on_prepare+0xda/0x190 [ 2172.950632] ? ktime_get_coarse_real_ts64+0xc2/0xd0 [ 2172.951036] __x64_sys_sendto+0x24/0x30 [ 2172.951382] do_syscall_64+0x90/0x170 ......
After calling bpf_exec_tx_verdict(), the size of msg_pl->sg may increase, e.g., when the BPF program executes bpf_msg_push_data().
If the BPF program sets cork_bytes and sg.size is smaller than cork_bytes, it will return -ENOSPC and attempt to roll back to the non-zero copy logic. However, during rollback, msg->msg_iter is reset, but since msg_pl->sg.size has been increased, subsequent executions will exceed the actual size of msg_iter. ''' iov_iter_revert(&msg->msg_iter, msg_pl->sg.size - orig_size); '''
The changes in this commit are based on the following considerations:
1. When cork_bytes is set, rolling back to non-zero copy logic is pointless and can directly go to zero-copy logic.
2. We can not calculate the correct number of bytes to revert msg_iter.
Assume the original data is "abcdefgh" (8 bytes), and after 3 pushes by the BPF program, it becomes 11-byte data: "abc?de?fgh?". Then, we set cork_bytes to 6, which means the first 6 bytes have been processed, and the remaining 5 bytes "?fgh?" will be cached until the length meets the cork_bytes requirement.
However, some data in "?fgh?" is not within 'sg->msg_iter' (but in msg_pl instead), especially the data "?" we pushed.
So it doesn't seem as simple as just reverting through an offset of msg_iter.
3. For non-TLS sockets in tcp_bpf_sendmsg, when a "cork" situation occurs, the user-space send() doesn't return an error, and the returned length is the same as the input length parameter, even if some data is cached.
Additionally, I saw that the current non-zero-copy logic for handling corking is written as: ''' line 1177 else if (ret != -EAGAIN) { if (ret == -ENOSPC) ret = 0; goto send_end; '''
So it's ok to just return 'copied' without error when a "cork" situation occurs.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-64k-debug-devel-matchedUpgrade kernel-devel-matchedUpgrade kernel-64k-debug-develUpgrade kernel-modulesUpgrade kernel-debugUpgrade kernel-rt-64k-modules-extraUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-coreUpgrade kernel-rt-64k-modulesUpgrade kernel-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-debug-develUpgrade kernel-develUpgrade perfUpgrade kernel-rt-64kUpgrade kernel-rt-64k-debug-modules-coreUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-devel-matchedUpgrade libperfUpgrade kernel-debug-uki-virtUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-extraUpgrade rvUpgrade kernel-64k-modules-extraUpgrade kernel-rt-debugUpgrade rtlaUpgrade kernel-rt-64k-debug-develUpgrade python3-perfUpgrade kernel-64k-debug-modules-coreUpgrade kernel-uki-virtUpgrade kernel-docUpgrade kernel-toolsUpgrade kernel-rt-modulesUpgrade kernel-64k-debug-modulesUpgrade kernel-64k-modules-coreUpgrade kernel-rt-64k-debug-coreUpgrade kernel-64k-debug-coreUpgrade kernel-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-64k-debugUpgrade kernel-64k-develUpgrade kernelUpgrade kernel-rt-debug-develUpgrade kernel-coreUpgrade kernel-64k-devel-matchedUpgrade kernel-zfcpdump-modulesUpgrade kernel-tools-libsUpgrade kernel-64kUpgrade kernel-abi-stablelistsUpgrade kernel-rt-64k-develUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-64k-debugUpgrade kernel-rt-64k-modules-coreUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdump-develUpgrade kernel-zfcpdump-coreUpgrade kernel-modules-coreUpgrade kernel-rt-64k-debug-modules-extraUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-uki-virt-addonsUpgrade kernel-rtUpgrade kernel-cross-headersUpgrade kernel-rt-64k-debug-modulesUpgrade kernel-rt-modules-extraUpgrade kernel-rt-modules-coreUpgrade kernel-debug-modules-coreUpgrade kernel-64k-debug-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-64k-coreUpgrade kernel-modules-extraUpgrade kernel-rt-64k-coreUpgrade kernel-headersUpgrade kernel-64k-modules | Jun 8, 2026 | May 19, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-livepatch-6.12.35-55.103Upgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perf6.12Upgrade kernel-libbpf-debuginfoUpgrade kernel-toolsUpgrade kernel6.12-debuginfo-common-x86_64Upgrade perfUpgrade perf6.12-debuginfoUpgrade python3-perfUpgrade kernel-modules-extraUpgrade kernel-tools-develUpgrade kernel-libbpfUpgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-6.1.144-170.251Upgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel6.12-modules-extraUpgrade kernel-libbpf-staticUpgrade python3-perf6.12-debuginfoUpgrade perf6.12Upgrade kernel-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel6.12Upgrade perf-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel6.12-debuginfo-common-aarch64 | Sep 9, 2025 | Jul 3, 2025 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jul 4, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade kernel-abi-stablelistsUpgrade python3-perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernel | Oct 14, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-libsUpgrade python3-perf | Nov 12, 2025 | Oct 10, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftool | Oct 24, 2025 | Oct 10, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 9, 2025 | Jul 3, 2025 |
| Suse | — | Upgrade kernel-kvmsmallUpgrade kernel-64kb-develUpgrade kernel-default-optionalUpgrade kernel-devel-azureUpgrade kernel-debugUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-macrosUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-defaultUpgrade dtb-rockchipUpgrade kernel-symsUpgrade kernel-syms-azureUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-rtUpgrade dtb-apmUpgrade kernel-devel-rtUpgrade kernel-docsUpgrade dtb-amdUpgrade dtb-armUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-azureUpgrade ocfs2-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade kernel-rt-livepatch-develUpgrade dtb-xilinxUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade ocfs2-kmp-rtUpgrade kernel-develUpgrade dtb-qcomUpgrade kernel-zfcpdumpUpgrade dtb-mediatekUpgrade reiserfs-kmp-defaultUpgrade dtb-renesasUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade kernel-source-azureUpgrade kernel-default-livepatchUpgrade kernel-azure-optionalUpgrade dtb-alteraUpgrade dlm-kmp-64kbUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade dtb-marvellUpgrade dtb-exynosUpgrade dtb-amazonUpgrade dtb-socionextUpgrade kernel-rt-extraUpgrade kernel-azure-extraUpgrade kernel-source-vanillaUpgrade dlm-kmp-rtUpgrade dtb-allwinnerUpgrade kernel-source-rtUpgrade kernel-default-manUpgrade kernel-azure-vdsoUpgrade kernel-64kb-extraUpgrade dtb-broadcomUpgrade dtb-nvidiaUpgrade gfs2-kmp-azureUpgrade kernel-rtUpgrade kernel-docs-htmlUpgrade dtb-appleUpgrade kernel-kvmsmall-vdsoUpgrade kernel-azure-develUpgrade kernel-azureUpgrade dtb-sprdUpgrade kernel-rt_debug-develUpgrade kernel-debug-vdsoUpgrade dtb-caviumUpgrade kselftests-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kselftests-kmp-azureUpgrade ocfs2-kmp-64kbUpgrade dtb-lgUpgrade dtb-freescaleUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-default-vdsoUpgrade kernel-default-develUpgrade kernel-default-baseUpgrade gfs2-kmp-defaultUpgrade kernel-64kb | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-oem-24.04bUpgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-azure-fipsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.14.0-32-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-realtimeUpgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-oem-24.04cUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-aws-fipsUpgrade linux-image-kvmUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-virtualUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-aws-fips-6.8Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-oem-6.14Upgrade linux-image-fipsUpgrade linux-image-oracle-6.14Upgrade linux-image-6.14.0-1012-oemUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-gke-64kUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-gcp-6.8Upgrade linux-image-generic-64k-6.14Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-raspiUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-100-genericUpgrade linux-image-xilinx-6.8Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-6.14.0-1013-awsUpgrade linux-image-generic-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-gcp-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-lowlatency-64kUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-22.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-virtual-6.14Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-ibmUpgrade linux-image-genericUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-aws-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-azure-fips-6.8Upgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-gkeop-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-lowlatencyUpgrade linux-image-virtual-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-oem-22.04cUpgrade linux-image-intel-iotgUpgrade linux-image-gcp-fipsUpgrade linux-image-oem-24.04Upgrade linux-image-oem-22.04aUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-aws-6.14Upgrade linux-image-azureUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-generic-64kUpgrade linux-image-fips-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-gkeopUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-raspi-6.14Upgrade linux-image-oem-24.04aUpgrade linux-image-nvidiaUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-azure-6.8Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-xilinxUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-azure-6.14Upgrade linux-image-gke-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gkeUpgrade linux-image-aws-64k-6.14Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-raspi-6.8 | Jul 7, 2025 | Jul 3, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub