CVE-2026-64354

Awaiting Analysis Awaiting Analysis - Queue

Linux Kernel BPF BTF Field Count Validation Flaw

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD, and btf_repeat_fields() expands repeatable fields from array elements into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields(). The remaining-capacity check performs the expanded field count calculation in u32. A malformed BTF can wrap that calculation, causing the check to pass even when the expanded field count exceeds the scratch array capacity. The following memcpy() can then write past the end of the array. Use checked addition and multiplication before copying repeated fields and reject impossible counts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64354

EUVD

EUVD-2026-48898

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper validation of BTF (BPF Type Format) repeated field counts during BPF_BTF_LOAD operations. A malformed BTF input can cause a calculation wrap-around, leading to an incorrect capacity check. This allows a memcpy operation to write beyond the intended memory buffer, potentially causing memory corruption or crashes.

Detection Guidance

This vulnerability affects the Linux kernel's BPF (Berkeley Packet Filter) component. Detection requires checking kernel version and BPF-related logs. Use 'uname -r' to check kernel version and 'dmesg | grep BTF' to look for BTF-related errors. If you suspect exploitation, monitor for kernel crashes or unusual BPF-related activity.

Impact Analysis

If exploited, this flaw could allow an attacker with local access to trigger memory corruption in the kernel. This might lead to system crashes, privilege escalation, or denial-of-service conditions. Systems running vulnerable Linux kernels could be affected if untrusted users have access to load BPF programs.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux BPF subsystem. Compliance impacts would only occur if exploitation led to unauthorized data access or system compromise, which is not specified in the provided context.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version. Disable BPF if not required by your system. Restrict unprivileged BPF usage via kernel parameters like 'kernel.unprivileged_bpf_disabled=1'. Monitor system logs for suspicious activity and apply kernel patches as soon as they are available.

Hi! I’m here to help you understand CVE-2026-64354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70