CVE-2026-63926: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data
In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: fix tail fragment offset in bpfmsgpushdata
When bpfmsgpushdata() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment.
The right fragment offset is page-local, but the code advances it with start, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent.
Advance the right fragment offset by the fragment-local delta, start - offset, which matches the length removed from the front of the original entry.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The issue occurs when bpf_msg_push_data() inserts data in the middle of a scatterlist entry that is not the first entry. That operation can cause the right-hand fragment offset to be advanced using a message-global position rather than the required fragment-local delta.
What is the impact of the incorrect offset calculation?
The resulting split scatterlist layout can become inconsistent. The supplied severity data rates the issue High, with high impacts to confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available, and the provided references identify stable Linux kernel commits containing the fix.