CVE-2026-64353

Awaiting Analysis Awaiting Analysis - Queue

BPF Inner Array Lookup Nullness Bypass

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its inner map template. A concrete inner array with a different max_entries value can then replace the template. After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template max_entries even though the runtime helper uses the concrete inner map max_entries. Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP, because the template max_entries does not prove that the key is in bounds for the concrete runtime map.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64353

EUVD

EUVD-2026-48897

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in how dynamic inner array lookups are handled in BPF (Berkeley Packet Filter) maps. Specifically, when an ARRAY_OF_MAPS uses an array created with BPF_F_INNER_MAP as its inner map template, a mismatch can occur between the template's max_entries and the concrete inner map's max_entries. This can lead to incorrect nullness elision during lookups, potentially allowing out-of-bounds access.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation. Detection requires checking kernel versions and BPF-related configurations. Use uname -a to check your kernel version and grep BPF_F_INNER_MAP in kernel headers or logs to identify affected systems.

Impact Analysis

This vulnerability could allow an attacker to perform out-of-bounds memory access in the Linux kernel, potentially leading to privilege escalation, denial of service, or information disclosure. Systems running vulnerable kernel versions may be at risk if BPF is enabled and used.

Compliance Impact

This vulnerability in the Linux kernel's BPF subsystem could potentially lead to memory safety issues or unauthorized access, which may impact compliance with data protection regulations like GDPR or HIPAA by compromising data integrity or confidentiality. However, the provided CVE details do not explicitly link this issue to compliance requirements.

Mitigation Strategies

Update your Linux kernel to the latest patched version to resolve this BPF-related vulnerability. Monitor kernel security advisories and apply updates promptly.

Hi! I’m here to help you understand CVE-2026-64353. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70