CVE-2026-64354

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF subsystem where the btf parse struct metas() function processes user-supplied BTF (BPF Type Format) during BPF BTF LOAD. The btf repeat fields() function expands repeatable fields into a fixed-size scratch array used by btf parse fields(). Because the remaining-capacity check uses u32 for the expanded field count calculation, a malformed BTF can cause an integer wrap. This allows the check to pass even if the count exceeds the array capacity, leading to a buffer overflow when memcpy() writes past the end of the array.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.