Linux kernel sockmap: 32-bit wrap in bpf_msg_pop_data bounds check runs the pop loop off the scatterlist

Impact

bpf_msg_pop_data() computed start + len in 32-bit before storing it in a u64, so a len near U32_MAX wrapped and passed the bounds check. The pop loop then ran past the end of the scatterlist and sk_msg_shift_left() called put_page() on the empty msg->sg.end slot, which the reporter's trace shows as a general protection fault with a KASAN null-pointer-deref range. The reachable outcome is a host kernel crash, with refcount manipulation on an unowned slot as the worse case. Same subsystem as the two bpf_msg_push_data bugs but a different helper, a different check and a different fix, so it must be patched on its own. For a GPU cluster whose networking datapath is BPF-based, this is an availability risk on nodes that cannot be drained cheaply.

Who can reach it

Local: requires the ability to attach a BPF sk_msg program to a socket (CAP_BPF/CAP_NET_ADMIN, or permissive unprivileged BPF) and then send through it. No network-only path.

What to do

Apply the stable kernel update that widens the addition to 64-bit and makes the pop counter unsigned (five stable branches carry the fix; see the git.kernel.org commits), then reboot each affected node. Interim exposure control is the same as for the other sockmap bugs: no unprivileged BPF, no CAP_BPF in tenant workloads.

References

Related entries

• Linux kernel io_uring: per-task restrictions are freed across exec, so post-exec rings are unrestrictedCVE-2026-80713 · Linux kernel io_uring (per-task restrictions dropped on exec)High
• Linux kernel qla2xxx: MSI-X vector count truncates to zero and the driver dereferences ZERO_SIZE_PTRCVE-2026-89856 · Linux kernel qla2xxx (MSI-X derived queue counts)High
• Linux kernel arm64 ptrace: tracer-modified x0 escapes seccomp re-evaluationCVE-2026-90347 · Linux kernel arm64 ptrace (orig_x0 vs x0 sync on syscall entry)High
• Linux kernel virtio-fs: double free of fs->vqs and fs->mq_map when queue setup fails during probeCVE-2026-93827 · Linux kernel virtio-fs (double free on virtio_fs_setup_vqs() probe failure)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds read): Out-of-bounds read in the ESXi GPU driver exposingCVE-2026-20751 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds read)High
• Intel Data Center GPU driver for VMware ESXi (out-of-bounds write): Out-of-bounds write in the ESXi GPU driver causingCVE-2026-20879 · Intel Data Center GPU driver for VMware ESXi (out-of-bounds write)High