Look up another CVE · open CVE-2026-74256 in the interactive tracker
CVE-2026-74256
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/core. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74256 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if (start >= offset + l || last > msg->sg.size) return -EINVAL; can then be passed with an out-of-range start/len, after which the pop loop runs off the end of the scatterlist and sk_msg_shift_left() calls put_page() on the empty msg->sg.end slot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline] RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline] RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984 Call Trace: <TASK> bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8 bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746 sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934 tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline] tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583 __sock_sendmsg+0x153/0x1c0 net/socket.c:802 __sys_sendto+0x326/0x430 net/socket.c:2265 __x64_sys_sendto+0xe3/0x100 net/socket.c:2268 do_syscall_64+0x14c/0x480 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Widen the addition with a (u64) cast so the bound is evaluated in 64-bit and a len near U32_MAX no longer wraps below msg->sg.size. While here, change pop from int to u32. It counts bytes against the unsigned scatterlist lengths and can never be negative, so the signed type only invites sign-confusion in the pop loop.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/core/filter.c
- What this is
- BPF [GENERAL] (Safe Dynamic Programs and Tools)MAINTAINERS section matched on net/core/filter.c · bpf@vger.kernel.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/core
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.0 | 5.10.261 | 9ef44ed6fb0c |
| 5.0 | 5.15.212 | d693c5ed67da |
| 5.0 | 6.1.178 | ba5cc05dae8f |
| 5.0 | 6.6.145 | c05a0ec1cdce |
| 5.0 | 6.12.97 | 17eb9832a10d |
| 5.0 | 6.18.40 | fe09dd288722 |
| 5.0 | 7.1.5 | e09f7bd72739 |
| 5.0 | 7.2 | a48802fb2cd2 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The flaw is in the BPF sk_msg helper bpf_msg_pop_data(), reached only from the sockmap egress verdict path via local sendmsg/sendto on a sockmap- or kTLS-attached socket (tcp_bpf_sendmsg/tls_sw_sendmsg → sk_psock_msg_verdict), matching kernel CNA BPF/sockmap Local guidance.
- AC:LAttack complexity, low
- start and len are ARG_ANYTHING (verifier unbounded); an sk_msg program can pick values whose u32 sum wraps below msg->sg.size (e.g. start=100, len≈U32_MAX) and trigger the bad path deterministically with a single sendmsg, with no race or external state.
- PR:NPrivileges required, none
- Triggering corruption requires only sendmsg on a socket already in a sockmap whose SK_MSG program calls bpf_msg_pop_data; on internet-facing kTLS/sockmap L7 proxies an unauthenticated remote client can reach this with no victim credentials, and arg2/arg3 are unconstrained by the verifier.
- UI:NUser interaction, none
- Exploitation needs only the attacker's own socket traffic and BPF-driven pop parameters; no independent victim mount, file open, or administrator action is required at trigger time.
- S:UScope, unchanged
- Out-of-bounds scatterlist manipulation corrupts kernel sk_msg/page state within the same kernel security authority and does not by itself cross VM, IOMMU, or hypervisor boundaries.
- C:HConfidentiality impact, high
- After the overflowed bound check, sk_msg_shift_left() walks past msg->sg.end, reading invalid scatterlist slots and dereferencing bogus page pointers via put_page(), yielding out-of-bounds kernel memory disclosure convertible to arbitrary read.
- I:HIntegrity impact, high
- The same over-run writes msg->sg.data[] entries and copy bitmap state beyond the fixed MAX_MSG_FRAGS ring, corrupting adjacent kernel objects with attacker-influenced scatterlist metadata suitable for control-flow hijack and privilege escalation.
- A:HAvailability impact, high
- The fix commit's KASAN trace shows a general protection fault/null-ptr-deref in sk_msg_shift_left() during bpf_msg_pop_data(); this reliably oopses the host and can panic even when full exploitation is not attempted.