CVE-2026-64354

Modified Modified - Updated After Analysis

Linux Kernel BPF BTF Field Count Validation Flaw

Publication date: 2026-07-25

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD, and btf_repeat_fields() expands repeatable fields from array elements into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields(). The remaining-capacity check performs the expanded field count calculation in u32. A malformed BTF can wrap that calculation, causing the check to pass even when the expanded field count exceeds the scratch array capacity. The following memcpy() can then write past the end of the array. Use checked addition and multiplication before copying repeated fields and reject impossible counts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-07-25

EPSS Evaluated

2026-11-07

NVD

CVE-2026-64354

EUVD

EUVD-2026-48898

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	6.12
linux	linux_kernel	From 6.11.6 (inc) to 6.12 (exc)
linux	linux_kernel	6.12
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 6.12.1 (inc) to 6.12.96 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of BTF (BPF Type Format) repeated field counts during BPF_BTF_LOAD operations. A malformed BTF input can cause a calculation wrap-around, leading to an incorrect capacity check. This allows a memcpy operation to write beyond the intended memory buffer, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability affects the Linux kernel's BPF (Berkeley Packet Filter) component. Detection requires checking kernel version and BPF-related logs. Use 'uname -r' to check kernel version and 'dmesg | grep BTF' to look for BTF-related errors. If you suspect exploitation, monitor for kernel crashes or unusual BPF-related activity.

Impact Analysis

If exploited, this flaw could allow an attacker with local access to trigger memory corruption in the kernel. This might lead to system crashes, privilege escalation, or denial-of-service conditions. Systems running vulnerable Linux kernels could be affected if untrusted users have access to load BPF programs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux BPF subsystem. Compliance impacts would only occur if exploitation led to unauthorized data access or system compromise, which is not specified in the provided context.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version. Disable BPF if not required by your system. Restrict unprivileged BPF usage via kernel parameters like 'kernel.unprivileged_bpf_disabled=1'. Monitor system logs for suspicious activity and apply kernel patches as soon as they are available.

Hi! I’m here to help you understand CVE-2026-64354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...