CVE-2026-63926
Received Received - Intake

BPF sockmap sockmap tail fragment offset vulnerability

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent. Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63926
EUVD
EUVD-2026-45699

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the BPF sockmap functionality. It involves incorrect handling of data insertion in scatterlist entries by the bpf_msg_push_data function. When data is inserted in the middle of a scatterlist entry, the function splits the entry into fragments but miscalculates the offset for the right fragment, causing layout inconsistencies.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF sockmap functionality. Detection requires checking kernel logs for related errors or kernel crashes. Monitor for messages about bpf_msg_push_data or sockmap issues. Use commands like dmesg | grep sockmap or journalctl -k | grep sockmap to check for errors.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption or denial of service in the Linux kernel. It may lead to system crashes, unexpected behavior, or privilege escalation if exploited. Systems using BPF sockmap features are particularly at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue related to data handling in the BPF subsystem. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the vulnerability. If immediate patching is not possible, disable BPF sockmap functionality by setting BPF_SOCKMAP to 'n' in the kernel configuration or blacklisting the module. Restart affected services after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63926. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart