In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy.
BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asan_memcpy (mm/kasan/shadow.c:105) bpf_msg_push_data (net/core/filter.c:2852 net/core/filter.c:2788) bpf_prog_9ed8b5711920a7d7+0x2e/0x36 sk_psock_msg_verdict (net/core/skmsg.c:934) tcp_bpf_sendmsg (net/ipv4/tcp_bpf.c:421 net/ipv4/tcp_bpf.c:584) __sys_sendto (net/socket.c:2206) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
Add an overflow check before the allocation.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-modules-extraUpgrade kernel6.12Upgrade kernel-tools-debuginfoUpgrade kernel6.12-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade perfUpgrade perf6.12Upgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12Upgrade kernel6.12-headersUpgrade kernel6.12-modules-extra-commonUpgrade perf-debuginfoUpgrade kernel-headersUpgrade bpftool-debuginfoUpgrade bpftool6.12-debuginfoUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel6.12-tools-develUpgrade kernel-livepatch-6.12.100-125.179Upgrade kernelUpgrade kernel6.12-toolsUpgrade python3-perfUpgrade perf6.12-debuginfoUpgrade kernel-tools-develUpgrade python3-perf-debuginfoUpgrade bpftool6.12Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-debuginfoUpgrade kernel-modules-extra-commonUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-livepatch-6.1.180-225.360Upgrade kernel6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64 | Aug 18, 2026 | Jul 27, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux-6.1Upgrade linux | Aug 2, 2026 | Aug 2, 2026 |
| Redhat_linux | — | No solution exists | Jul 30, 2026 | Jul 27, 2026 |
| Ubuntu | — | Upgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-6.8.0-1035-nvidia-tegra-rtUpgrade linux-image-nvidia-tegraNo solution existsUpgrade linux-image-6.8.0-1035-nvidia-tegra | Sep 21, 2026 | Sep 18, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 14, 2026 | Jul 27, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub