Linux kernel sockmap: bpf_msg_push_data mis-advances split fragment offset, corrupting scatterlist layout

Impact

When bpf_msg_push_data() inserts data in the middle of a scatterlist entry it splits the entry, but advances the right fragment's page-local offset by the message-global insertion point. For inserts into any entry other than the first, the offset over-advances and the resulting split layout is inconsistent, giving memory corruption potential in the socket message path. This lives in the sockmap/sk_msg path, which is reached by BPF programs attached to sockets - exactly the mechanism service meshes, sidecar-free L7 proxies and Cilium-style datapaths use on Kubernetes GPU nodes. A tenant or workload able to load such a program, or a bug in the cluster's own datapath program, can destabilize the host kernel on a node that is expensive to drain.

Who can reach it

Local: requires the ability to load and attach a BPF sockmap program (CAP_BPF/CAP_NET_ADMIN or an unprivileged-BPF-permissive configuration), then send traffic through the attached socket. Not remotely reachable on its own.

What to do

Apply the stable kernel update that advances the fragment offset by the fragment-local delta (five stable branches carry the fix; see the git.kernel.org commits). Reboot each affected node, or use livepatching if your distribution ships it for this commit. Until patched, the exposure is limited by who can attach sockmap programs - keep unprivileged BPF disabled and restrict CAP_BPF to the cluster datapath, not tenant workloads.

References

Related entries

• Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High
• Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS andCVE-2026-64247 · Linux kernel (arch/x86/kvm)High
• Linux kernel sockmap: integer overflow in bpf_msg_push_data allocation leads to out-of-bounds memcpyCVE-2026-64548 · Linux kernel bpf sockmap (bpf_msg_push_data copy+len integer overflow)High
• Linux kernel virtio-net: loose length check in receive_big() lets a malicious backend write past the frag arrayCVE-2026-64552 · Linux kernel virtio-net (receive_big() length validation)High
• Linux kernel sockmap: 32-bit wrap in bpf_msg_pop_data bounds check runs the pop loop off the scatterlistCVE-2026-74256 · Linux kernel bpf sockmap (bpf_msg_pop_data bounds check overflow)High
• Linux kernel io_uring: per-task restrictions are freed across exec, so post-exec rings are unrestrictedCVE-2026-80713 · Linux kernel io_uring (per-task restrictions dropped on exec)High