CVE-2026-63830: Linux Kernel Privilege Escalation Flaw

CVE-2026-63830 Overview

CVE-2026-63830 is a Linux kernel vulnerability in the net/skmsg subsystem. The flaw stems from the sk_msgsg.copy bitmap losing synchronization with msg->sg.data[] entries during scatterlist transforms. The bitmap tracks scatterlist entry ownership and prevents BPF programs from exposing externally backed pages, such as splice-backed file page-cache pages, as writable ctx->data.

When transforms move, copy, split, or compact entries without moving the matching sg.copy bit, an externally backed entry can land in a slot with a cleared bit. A subsequent SK_MSG verdict program can then modify the original page cache through sg_virt(sge).

Critical Impact
BPF SK_MSG programs can write to page-cache memory not owned by the socket message, corrupting file-backed pages shared with other processes.

Affected Products

Linux kernel builds with CONFIG_BPF_SYSCALL and sk_msg support
Kernels using SK_MSG verdict programs and TLS sendfile/splice paths
Multiple stable branches referenced by kernel.org patches

Discovery Timeline

2026-07-19 - CVE-2026-63830 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-63830

Vulnerability Analysis

The sk_msg structure carries a scatterlist sg.data[] and a parallel sg.copy bitmap. Each set bit marks the corresponding scatterlist entry as externally backed, meaning the page is not private to the sk_msg. The helper sk_msg_compute_data_pointers() checks this bit before exposing the entry as writable BPF context data.

Several transform paths mutate sg.data[] without carrying the matching bit along. The affected helpers include the BPF msg_pull_data, msg_push_data, and msg_pop_data operations, plus sk_msg_shift_left(), sk_msg_shift_right(), sk_msg_xfer(), and tls_split_open_record(). After a shift or split, an entry backed by a page-cache page can occupy a new slot whose sg.copy bit is clear.

Root Cause

The root cause is missing bitmap bookkeeping across scatterlist transforms. The sg.copy bit is metadata that must move whenever the entry it describes moves. Existing code updates sg.data[] slots but leaves the bitmap stale, breaking the invariant that sk_msg_compute_data_pointers() depends on.

Attack Vector

An attacker with the ability to load a SK_MSG BPF program, or influence one running on socket traffic that traverses sendfile or splice paths, can trigger a transform that shifts an externally backed entry into a slot with a cleared bit. The verdict program then obtains a writable pointer to sg_virt(sge) and issues stores that reach the underlying page-cache page, corrupting file data shared with unrelated processes. The TLS open-record split path creates a partial tail entry that is particularly exposed.

No verified public exploit is available. The vulnerability manifests through legitimate BPF store instructions against context data, so exploitation does not require memory-corruption primitives.

Detection Methods for CVE-2026-63830

Indicators of Compromise

Unexpected modifications to page-cache contents of files served through sendfile or splice on sockets attached to SK_MSG programs
TLS records with inconsistent plaintext after open-record splitting on affected kernels
Loaded BPF SK_MSG programs performing stores into ctx->data on kernels lacking the fix

Detection Strategies

Inventory kernel versions across Linux fleet and cross-reference with the stable commits listed in the kernel.org references
Audit loaded BPF programs with bpftool prog show and inspect SK_MSG types for untrusted authors
Monitor for CAP_BPF or CAP_SYS_ADMIN grants to workloads that do not require them

Monitoring Recommendations

Alert on bpf() syscalls loading BPF_PROG_TYPE_SK_MSG programs from non-privileged service accounts
Log sockmap/sockhash attach and detach operations for review against expected baselines
Track integrity of files served through kernel TLS or sendfile to detect anomalous content drift

How to Mitigate CVE-2026-63830

Immediate Actions Required

Apply the upstream kernel patches referenced by kernel.org and rebuild or upgrade affected kernels
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted workloads only, limiting who can load SK_MSG programs
Audit existing sockmap/sockhash deployments and remove programs that are not required

Patch Information

The fix keeps sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. It clears the bit when an entry is replaced by a newly allocated private page or freed. The change covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.

Stable commits: 0eb4c16c4a, 1acdd14c09, 21ed9540a8, 31a110642b, 406e8a651a, 9bb86d8184, d22cc92bc4, f126eed589.

Workarounds

Disable loading of BPF_PROG_TYPE_SK_MSG programs on hosts that do not require sockmap acceleration
Set kernel.unprivileged_bpf_disabled=1 to prevent unprivileged BPF program loading
Avoid pairing SK_MSG verdict programs with sendfile or splice workloads until patched

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
bpftool prog show | grep -i sk_msg