SECUFOCUSNOW
Home›CVE index›CVE-2026-64548
Review reviewHigh

CVE-2026-64548

Linux

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asa...

CVSS
8.4
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.28
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.4

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() When the scatterlist ring is full or nearly full, bpf_msg_push_data() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3_type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy. BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asa...

Affected product and versions

Product
Linux
Affected versions
>= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < f1644c9508d24f50dd9e8ebe8d3ba86e0996d2f5, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < a12b1575f9feabd91695a9e9d004862f7195fa25, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < ff39d0e3b4feeb65ca43c453d7c75fdf872ded0d, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < 888706a76286c547bd035432602571e8024b5305, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < db77b6bb6e6edb79b10b4efcce346eec5582d588, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < 4e40056bb5c829f0423f0a6694a0477726d2147e, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < bd004716ba75fed6d185795c85cdc92540ebeaab, >= 6fff607e2f14bd7c63c06c464a6f93b8efbabe28 < 0c0a8ed85349dae298712d79cb276acfeb794d82, >= 4.20
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available