Look up another CVE · open CVE-2026-63830 in the interactive tracker
CVE-2026-63830
net: skmsg: preserve sg.copy across SG transforms
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem include/linux. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63830 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.177-1 | Update the kernel and reboot. Fixed in 6.1.177-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.95-1 | Update the kernel and reboot. Fixed in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/linux/skmsg.h
net/core/filter.c
net/core/skmsg.c
net/tls/tls_sw.c
- What this is
- BPF [L7 FRAMEWORK] (sockmap)MAINTAINERS section matched on include/linux/skmsg.h · netdev@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 9.4 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Lsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.37%, higher than 29.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/linux
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.20 | 5.10.261 | f126eed589ee |
| 4.20 | 5.15.212 | 31a110642b5f |
| 4.20 | 6.1.177 | 9bb86d8184b3 |
| 4.20 | 6.6.144 | 0eb4c16c4adb |
| 4.20 | 6.12.95 | d22cc92bc412 |
| 4.20 | 6.18.38 | 1acdd14c0990 |
| 4.20 | 7.1.3 | 21ed9540a8e1 |
| 4.20 | 7.2 | 406e8a651a7b |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4717-1 | 2026-08-05 | bullseye 5.10.262-1 | tracker |
| DLA-4700-1 | 2026-07-26 | bullseye 6.1.177-1~deb11u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is exercised on the kTLS/TCP send path when splice-backed page-cache pages in an sk_msg are processed by an SK_MSG BPF verdict on network sockets; a remote TLS peer can trigger this on internet-facing servers (HTTPS, service-mesh edge nodes) that serve file-backed responses via splice/sendfile.
- AC:LAttack complexity, low
- The attacker controls the traffic patterns, message sizes, and splice-backed data needed to hit the desynchronized transform paths (bpf_msg_push/pop/pull, sk_msg shift/xfer, tls_split_open_record); no race against unrelated system state is required.
- PR:NPrivileges required, none
- On production kTLS servers with an attached SK_MSG BPF program (common in Cilium/Cloudflare-class deployments), an unauthenticated remote peer can trigger the faulty transforms without any credentials on the victim; a fully local exploit via user-namespace CAP_NET_ADMIN is also possible but is not the highest-severity case.
- UI:NUser interaction, none
- Exploitation requires only network traffic to a vulnerable server (or local socket I/O); no victim user action such as opening a file or mounting a filesystem is needed beyond normal server operation.
- S:UScope, unchanged
- Impact remains within the kernel's security authority (page-cache corruption via the network/BPF stack); it does not cross a VM-hypervisor or IOMMU boundary even though corrupted cache pages may affect other processes.
- C:HConfidentiality impact, high
- Exposing splice-backed page-cache pages as writable BPF ctx->data gives the attacker a kernel memory write primitive over shared file cache pages, which can be leveraged to read or infer sensitive file contents served from or mapped through the corrupted pages.
- I:HIntegrity impact, high
- The commit explicitly states BPF stores through the incorrectly writable ctx->data can modify the original page cache, constituting arbitrary integrity corruption of file-backed data beyond the socket buffer.
- A:LAvailability impact, low
- While the primary impact is data corruption rather than a kernel oops, corrupting shared page-cache pages of files actively served to other clients can cause sustained service disruption and repeated application-level failures; when uncertain, availability impact above None is appropriate.