Linux kernel sockmap: integer overflow in bpf_msg_push_data allocation leads to out-of-bounds memcpy

Impact

In the copy fallback path taken when the scatterlist ring is full, bpf_msg_push_data() computes copy + len in 32-bit arithmetic for the page allocation size. Because len arrives from BPF as ARG_ANYTHING, a crafted value wraps the sum to a small number, producing an undersized allocation followed by an out-of-bounds memcpy - the reporter's KASAN trace shows a page fault inside __asan_memcpy from the tcp_bpf_sendmsg path. That is heap corruption in the host kernel reachable from the socket send path of a process whose socket has a sockmap program attached. On GPU nodes running a BPF-based datapath, anyone who can attach such a program turns this into a host kernel compromise or panic, and the node must be drained to recover.

Who can reach it

Local: requires the ability to load and attach a BPF sockmap/sk_msg program (CAP_BPF plus CAP_NET_ADMIN, or a permissive unprivileged-BPF setting), then drive sendmsg traffic through the socket. Distinct from the fragment-offset bug in CVE-2026-63926 - same function, different code path and different fix.

What to do

Apply the stable kernel update that adds the overflow check before the allocation (five stable branches carry the fix; see the git.kernel.org commits). Reboot each node after patching, or livepatch if your vendor offers it for this commit. Meanwhile confirm that unprivileged BPF is disabled and that tenant pods do not hold CAP_BPF.

References

Related entries

• Linux kernel virtio-net: loose length check in receive_big() lets a malicious backend write past the frag arrayCVE-2026-64552 · Linux kernel virtio-net (receive_big() length validation)High
• Linux kernel sockmap: 32-bit wrap in bpf_msg_pop_data bounds check runs the pop loop off the scatterlistCVE-2026-74256 · Linux kernel bpf sockmap (bpf_msg_pop_data bounds check overflow)High
• Linux kernel io_uring: per-task restrictions are freed across exec, so post-exec rings are unrestrictedCVE-2026-80713 · Linux kernel io_uring (per-task restrictions dropped on exec)High
• Linux kernel qla2xxx: MSI-X vector count truncates to zero and the driver dereferences ZERO_SIZE_PTRCVE-2026-89856 · Linux kernel qla2xxx (MSI-X derived queue counts)High
• Linux kernel arm64 ptrace: tracer-modified x0 escapes seccomp re-evaluationCVE-2026-90347 · Linux kernel arm64 ptrace (orig_x0 vs x0 sync on syscall entry)High
• Linux kernel virtio-fs: double free of fs->vqs and fs->mq_map when queue setup fails during probeCVE-2026-93827 · Linux kernel virtio-fs (double free on virtio_fs_setup_vqs() probe failure)High