CVE-2026-63830

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the sk msg sg.copy bitmap, which tracks scatterlist entry ownership, becomes desynchronized during certain transformations. The sg.copy bitmap is intended to prevent sk msg compute data pointers() from exposing non-private pages, such as splice-backed file page-cache pages, through writable BPF ctx->data. However, several transform paths move, copy, split, or compact msg->sg.data[] entries without updating the corresponding sg.copy bit. This can result in an externally backed entry being placed in a slot with a clear copy bit, allowing a subsequent SK MSG verdict to expose sg virt(sge) as writable ctx->data, which enables BPF stores to modify the original page cache. This affects the BPF pull, push, and pop helpers, as well as the functions sk msg shift left(), sk msg shift right(), sk msg xfer(), and tls split open record().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.