CVE-2026-64548: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64548 Overview

CVE-2026-64548 is an integer overflow vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) sockmap subsystem. The flaw resides in the bpf_msg_push_data() function within net/core/filter.c. When the scatterlist ring is full or nearly full, the function enters a copy fallback path and computes copy + len for the page allocation size. Because len originates from BPF with arg3_type = ARG_ANYTHING and both values are u32, a crafted len can wrap the sum to a small value. The undersized allocation is followed by an out-of-bounds memcpy, producing kernel memory corruption.

Critical Impact
A local attacker with the ability to load BPF programs can trigger an out-of-bounds write in kernel memory, leading to system compromise, privilege escalation, or denial of service.

Affected Products

Linux kernel versions containing the vulnerable bpf_msg_push_data() implementation in net/core/filter.c
Systems with BPF sockmap functionality enabled and BPF program loading permitted
Multiple stable kernel branches, as indicated by the eight backport commits published on kernel.org

Discovery Timeline

2026-07-27 - CVE-2026-64548 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64548

Vulnerability Analysis

The vulnerability affects the BPF sockmap message-push helper used by socket redirection programs attached via sk_psock_msg_verdict. When user-supplied len is combined with copy inside bpf_msg_push_data(), both u32 operands can produce a value that exceeds UINT_MAX, wrapping around to a small integer. The kernel then allocates a page-sized buffer based on this wrapped value and performs a memcpy using the original, unwrapped length. The resulting out-of-bounds write corrupts adjacent kernel heap objects, as evidenced by the KASAN report showing a page fault during __asan_memcpy invoked from bpf_msg_push_data.

Root Cause

The root cause is missing bounds validation on arithmetic performed with attacker-controllable BPF arguments [CWE-190 Integer Overflow]. The arg3_type = ARG_ANYTHING declaration allows a BPF program to pass arbitrary 32-bit values into len without verifier constraints. The kernel then trusts the sum copy + len when sizing the fallback page allocation without checking for wraparound.

Attack Vector

Exploitation requires local access and the ability to load a BPF program attached to a sockmap with a message verdict hook. A crafted program calls bpf_msg_push_data() with a len value chosen to overflow copy + len. When the scatterlist ring reaches the fallback path, the undersized allocation is followed by the oversized memcpy, corrupting kernel memory. The reachable call chain runs from __sys_sendto through tcp_bpf_sendmsg and sk_psock_msg_verdict into bpf_msg_push_data. The fix, distributed across kernel commits including 0c0a8ed8, 4e40056b, 888706a7, a12b1575, bd004716, db77b6bb, f1644c95, and ff39d0e3, adds an explicit overflow check before the allocation.

// Vulnerable pattern (conceptual - see kernel commits for actual fix)
// copy + len can wrap when len is attacker-controlled u32
// Fix adds: if (check_add_overflow(copy, len, &alloc_size)) return -EINVAL;

Detection Methods for CVE-2026-64548

Indicators of Compromise

Kernel oops or panic entries referencing bpf_msg_push_data in net/core/filter.c around lines 2788 and 2852
KASAN reports flagging __asan_memcpy with call traces through sk_psock_msg_verdict and tcp_bpf_sendmsg
Unexpected page fault messages of the form unable to handle page fault for address: referencing shadow memory ranges
Unusual loading of BPF programs of type BPF_PROG_TYPE_SK_MSG by non-administrative workloads

Detection Strategies

Audit bpf() syscall usage with auditd rules capturing BPF_PROG_LOAD and program attachment to sockmap objects
Monitor /sys/kernel/debug/tracing and bpftool prog show output for unexpected sk_msg programs
Correlate kernel ring buffer messages (dmesg) with process telemetry to identify processes triggering bpf_msg_push_data crashes

Monitoring Recommendations

Ingest kernel logs and eBPF telemetry into a centralized analytics platform for cross-host correlation of BPF activity
Alert on any KASAN or Oops event referencing net/core/filter.c or net/core/skmsg.c
Track processes invoking sendto() on TCP sockets attached to sockmaps, especially from unprivileged containers

How to Mitigate CVE-2026-64548

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 0c0a8ed8, 4e40056b, 888706a7, a12b1575, bd004716, db77b6bb, f1644c95, and ff39d0e3
Update to a stable kernel release that includes the overflow check in bpf_msg_push_data()
Restrict unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1
Review container and workload configurations that grant CAP_BPF, CAP_SYS_ADMIN, or CAP_NET_ADMIN

Patch Information

The fix adds an explicit overflow check before the fallback page allocation in bpf_msg_push_data(). Patches are available across multiple stable branches. See Kernel Git Commit 0c0a8ed, Kernel Git Commit 4e40056, Kernel Git Commit 888706a, Kernel Git Commit a12b157, Kernel Git Commit bd00471, Kernel Git Commit db77b6b, Kernel Git Commit f1644c9, and Kernel Git Commit ff39d0e3.

Workarounds

Disable unprivileged BPF program loading via sysctl kernel.unprivileged_bpf_disabled=1 to reduce the attacker population
Remove CAP_BPF and CAP_NET_ADMIN from container runtimes and workloads that do not require socket redirection
Where feasible, avoid attaching BPF_PROG_TYPE_SK_MSG programs to sockmaps on multi-tenant hosts until patches are applied

bash

# Restrict unprivileged BPF until kernel patches are deployed
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf

# Inventory active sk_msg programs
bpftool prog show | grep -i sk_msg