CVE-2026-63926 (GCVE-0-2026-63926)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:55 – Updated: 2026-08-05 12:37
VLAI
Title
bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent. Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < f14609d8146707452e0822f3c8154674ce677251 (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < d81b323af2dcee47573907ccb89c0df9b45cb2e2 (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < aeb95146848d12206e1b2cfacd4f40e21ce81d94 (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 96b72672ce849a1402730238e64d9b20bf06a96d (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 3075c21d2d76c0067f4a382765b43d6cc10470f1 (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 5e19028667963fb371ebb00cecc2a473ef92056b (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < 63f64a510c7917658ddf4d073ece73914ee25346 (git)
Affected: 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 , < f72eed9b84fb771019a955908132410a9ba9ea3f (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.20
Unaffected: 0 , < 4.20 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f14609d8146707452e0822f3c8154674ce677251",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "d81b323af2dcee47573907ccb89c0df9b45cb2e2",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "aeb95146848d12206e1b2cfacd4f40e21ce81d94",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "96b72672ce849a1402730238e64d9b20bf06a96d",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "3075c21d2d76c0067f4a382765b43d6cc10470f1",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "5e19028667963fb371ebb00cecc2a473ef92056b",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "63f64a510c7917658ddf4d073ece73914ee25346",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            },
            {
              "lessThan": "f72eed9b84fb771019a955908132410a9ba9ea3f",
              "status": "affected",
              "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/filter.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "lessThan": "4.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n\nWhen bpf_msg_push_data() inserts data in the middle of a scatterlist\nentry, it splits the original entry into a left fragment and a right\nfragment.\n\nThe right fragment offset is page-local, but the code advances it with\n`start`, which is the message-global insertion point. For inserts into a\nnon-first SG entry, this over-advances the offset and leaves the split\nlayout inconsistent.\n\nAdvance the right fragment offset by the fragment-local delta,\n`start - offset`, which matches the length removed from the front of the\noriginal entry."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached through the BPF sk_msg/sockmap send path (sendmsg \u2192 tcp_bpf_send_verdict \u2192 sk_psock_msg_verdict \u2192 bpf_msg_push_data), which requires local syscalls and BPF setup; per kernel CNA guidance, BPF/sockmap issues are scored as Local rather than Network.\nAC:L - An attacker who can load a sk_msg BPF program fully controls the insertion offset and can reliably build multi-fragment scatterlist messages (e.g., via large sendmsg/sendfile) to hit the non-first-entry split path; a public PoC demonstrates deterministic triggering without races or external victim state.\nPR:N - While direct exploitation requires CAP_NET_ADMIN+CAP_BPF to load sockmap/sk_msg programs (obtainable as PR:L via user namespaces), the highest-impact reasonable scenario is an unauthenticated remote client triggering a pre-deployed internet-facing kTLS/sockmap proxy whose sk_msg BPF calls bpf_msg_push_data during outbound processing, requiring no privileges on the victim host.\nUI:N - Exploitation requires no victim user interaction beyond normal network I/O to a service that already runs sockmap/sk_msg BPF; the attacker does not need the victim to mount filesystems, open files, or take other deliberate actions.\nS:U - Impact is kernel heap memory corruption within the same kernel security authority (privilege escalation, memory disclosure, or crash), not a cross-boundary escape such as VM guest-to-host or IOMMU bypass.\nC:H - The incorrect rsge.offset over-advances the page-local offset for non-first scatterlist fragments, causing out-of-bounds reads when subsequent helpers (e.g., bpf_msg_pull_data via sg_virt/memcpy) or the TCP send path consume the corrupted entry; the public PoC shows a 32,752-byte OOB read/UAF.\nI:H - Scatterlist metadata corruption produces inconsistent length/offset pairs that can drive out-of-bounds kernel memory access and is a standard heap corruption primitive potentially weaponizable for arbitrary write or control-flow hijack, not merely a bounded data error.\nA:H - Corrupted scatterlist state can cause kernel oops/panic from out-of-bounds page access (as shown in the PoC KASAN trace) or destabilize subsequent sk_msg/TCP/kTLS transmit processing, resulting in denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:21.277Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f14609d8146707452e0822f3c8154674ce677251"
        },
        {
          "url": "https://git.kernel.org/stable/c/d81b323af2dcee47573907ccb89c0df9b45cb2e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/aeb95146848d12206e1b2cfacd4f40e21ce81d94"
        },
        {
          "url": "https://git.kernel.org/stable/c/96b72672ce849a1402730238e64d9b20bf06a96d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3075c21d2d76c0067f4a382765b43d6cc10470f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e19028667963fb371ebb00cecc2a473ef92056b"
        },
        {
          "url": "https://git.kernel.org/stable/c/63f64a510c7917658ddf4d073ece73914ee25346"
        },
        {
          "url": "https://git.kernel.org/stable/c/f72eed9b84fb771019a955908132410a9ba9ea3f"
        }
      ],
      "title": "bpf: sockmap: fix tail fragment offset in bpf_msg_push_data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63926",
    "datePublished": "2026-07-19T14:55:27.154Z",
    "dateReserved": "2026-07-19T07:54:57.021Z",
    "dateUpdated": "2026-08-05T12:37:21.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63926",
      "date": "2026-09-21",
      "epss": "0.00185",
      "percentile": "0.08321"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f14609d8146707452e0822f3c8154674ce677251",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d81b323af2dcee47573907ccb89c0df9b45cb2e2",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aeb95146848d12206e1b2cfacd4f40e21ce81d94",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "96b72672ce849a1402730238e64d9b20bf06a96d",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3075c21d2d76c0067f4a382765b43d6cc10470f1",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5e19028667963fb371ebb00cecc2a473ef92056b",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "63f64a510c7917658ddf4d073ece73914ee25346",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f72eed9b84fb771019a955908132410a9ba9ea3f",
                    "status": "affected",
                    "version": "6fff607e2f14bd7c63c06c464a6f93b8efbabe28",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/filter.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.20"
                  },
                  {
                    "lessThan": "4.20",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: sockmap: fix tail fragment offset in bpf_msg_push_data\n\nWhen bpf_msg_push_data() inserts data in the middle of a scatterlist\nentry, it splits the original entry into a left fragment and a right\nfragment.\n\nThe right fragment offset is page-local, but the code advances it with\n`start`, which is the message-global insertion point. For inserts into a\nnon-first SG entry, this over-advances the offset and leaves the split\nlayout inconsistent.\n\nAdvance the right fragment offset by the fragment-local delta,\n`start - offset`, which matches the length removed from the front of the\noriginal entry."
          }
        ],
        "id": "CVE-2026-63926",
        "lastModified": "2026-07-27T17:44:23.777",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:10.913",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3075c21d2d76c0067f4a382765b43d6cc10470f1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5e19028667963fb371ebb00cecc2a473ef92056b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/63f64a510c7917658ddf4d073ece73914ee25346"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/96b72672ce849a1402730238e64d9b20bf06a96d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/aeb95146848d12206e1b2cfacd4f40e21ce81d94"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d81b323af2dcee47573907ccb89c0df9b45cb2e2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f14609d8146707452e0822f3c8154674ce677251"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f72eed9b84fb771019a955908132410a9ba9ea3f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T07:05:48+00:00",
      "cve": "CVE-2026-63926",
      "id": "CVE-2026-63926",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63926.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:46:20Z",
      "cve": "CVE-2026-63926",
      "id": "CVE-2026-63926",
      "initial_release_date": "2026-07-21T13:03:25Z",
      "product_status:known_affected": "636",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-63926",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-63926.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.