CVE-2026-64353: bpf: Keep dynamic inner array lookups nullable
In the Linux kernel, the following vulnerability has been resolved:
bpf: Keep dynamic inner array lookups nullable
An ARRAYOFMAPS can use an array created with BPFFINNERMAP as its inner map template. A concrete inner array with a different maxentries value can then replace the template.
After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template maxentries even though the runtime helper uses the concrete inner map maxentries.
Do not elide lookup result nullness for maps marked with BPFFINNERMAP, because the template maxentries does not prove that the key is in bounds for the concrete runtime map.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
An attacker needs local access with low privileges and must be able to use BPF maps. The affected setup uses an ARRAY_OF_MAPS whose inner-map template was created with BPF_F_INNER_MAP and is replaced by a concrete inner array with a different max_entries value.
What is the impact of successful exploitation?
The issue can cause an availability impact in the Linux kernel. The supplied CVSS vector rates it as local, low-complexity, low-privilege, with no user interaction required and high availability impact.
Is there a fix available?
Yes. A patch is available, with stable kernel references provided for the fix.