CVE-2026-74256

Received Received - Intake

Integer Overflow in Linux Kernel BPF sockmap

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if (start >= offset + l || last > msg->sg.size) return -EINVAL; can then be passed with an out-of-range start/len, after which the pop loop runs off the end of the scatterlist and sk_msg_shift_left() calls put_page() on the empty msg->sg.end slot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline] RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline] RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984 Call Trace: <TASK> bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8 bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746 sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934 tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline] tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583 __sock_sendmsg+0x153/0x1c0 net/socket.c:802 __sys_sendto+0x326/0x430 net/socket.c:2265 __x64_sys_sendto+0xe3/0x100 net/socket.c:2268 do_syscall_64+0x14c/0x480 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Widen the addition with a (u64) cast so the bound is evaluated in 64-bit and a len near U32_MAX no longer wraps below msg->sg.size. While here, change pop from int to u32. It counts bytes against the unsigned scatterlist lengths and can never be negative, so the signed type only invites sign-confusion in the pop loop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74256

EUVD

EUVD-2026-59403

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the BPF (Berkeley Packet Filter) sockmap functionality. It involves an integer overflow in the bounds check of the bpf_msg_pop_data() function. The issue occurs because start and len are 32-bit values, causing start + len to wrap around before being stored in a 64-bit variable. This allows an out-of-range start/len to bypass the bounds check, leading to a buffer overflow in the scatterlist and a kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) and sockmap functionality. Detection requires checking kernel logs for general protection faults or null-pointer dereferences related to sk_msg_shift_left or bpf_msg_pop_data. Monitor for crashes in BPF programs handling socket messages.

Impact Analysis

This vulnerability could allow an attacker with local access to trigger a kernel panic or execute arbitrary code in the kernel, leading to system crashes or privilege escalation. It affects systems using BPF sockmap features, which are commonly used in networking and packet processing.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux operating system affecting BPF (Berkeley Packet Filter) and sockmap functionality. It does not directly relate to data protection, privacy, or security controls required by GDPR or HIPAA. Compliance impact would depend on system configuration and use case rather than the vulnerability itself.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, disable BPF and sockmap functionality by unloading related kernel modules (e.g., bpf, sockmap) or restricting BPF program execution via kernel parameters.

Hi! I’m here to help you understand CVE-2026-74256. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70