Look up another CVE · open CVE-2026-63926 in the interactive tracker
CVE-2026-63926
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/core. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-63926 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent. Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/core/filter.c
- What this is
- BPF [GENERAL] (Safe Dynamic Programs and Tools)MAINTAINERS section matched on net/core/filter.c · bpf@vger.kernel.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.20 | 5.10.259 | f14609d81467 |
| 4.20 | 5.15.210 | d81b323af2dc |
| 4.20 | 6.1.176 | aeb95146848d |
| 4.20 | 6.6.143 | 96b72672ce84 |
| 4.20 | 6.12.93 | 3075c21d2d76 |
| 4.20 | 6.18.35 | 5e1902866796 |
| 4.20 | 7.0.12 | 63f64a510c79 |
| 4.20 | 7.1 | f72eed9b84fb |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached through the BPF sk_msg/sockmap send path (sendmsg → tcp_bpf_send_verdict → sk_psock_msg_verdict → bpf_msg_push_data), which requires local syscalls and BPF setup; per kernel CNA guidance, BPF/sockmap issues are scored as Local rather than Network.
- AC:LAttack complexity, low
- An attacker who can load a sk_msg BPF program fully controls the insertion offset and can reliably build multi-fragment scatterlist messages (e.g., via large sendmsg/sendfile) to hit the non-first-entry split path; a public PoC demonstrates deterministic triggering without races or external victim state.
- PR:NPrivileges required, none
- While direct exploitation requires CAP_NET_ADMIN+CAP_BPF to load sockmap/sk_msg programs (obtainable as PR:L via user namespaces), the highest-impact reasonable scenario is an unauthenticated remote client triggering a pre-deployed internet-facing kTLS/sockmap proxy whose sk_msg BPF calls bpf_msg_push_data during outbound processing, requiring no privileges on the victim host.
- UI:NUser interaction, none
- Exploitation requires no victim user interaction beyond normal network I/O to a service that already runs sockmap/sk_msg BPF; the attacker does not need the victim to mount filesystems, open files, or take other deliberate actions.
- S:UScope, unchanged
- Impact is kernel heap memory corruption within the same kernel security authority (privilege escalation, memory disclosure, or crash), not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.
- C:HConfidentiality impact, high
- The incorrect rsge.offset over-advances the page-local offset for non-first scatterlist fragments, causing out-of-bounds reads when subsequent helpers (e.g., bpf_msg_pull_data via sg_virt/memcpy) or the TCP send path consume the corrupted entry; the public PoC shows a 32,752-byte OOB read/UAF.
- I:HIntegrity impact, high
- Scatterlist metadata corruption produces inconsistent length/offset pairs that can drive out-of-bounds kernel memory access and is a standard heap corruption primitive potentially weaponizable for arbitrary write or control-flow hijack, not merely a bounded data error.
- A:HAvailability impact, high
- Corrupted scatterlist state can cause kernel oops/panic from out-of-bounds page access (as shown in the PoC KASAN trace) or destabilize subsequent sk_msg/TCP/kTLS transmit processing, resulting in denial of service.