CVE-2026-64548

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bpf, sockmap component where the bpf msg push data() function fails to properly validate the sum of copy and len when the scatterlist ring is full or nearly full. Because len is provided by BPF with arg3 type = ARG ANYTHING and both variables are u32, a specifically crafted len can cause an integer wrap-around. This results in an undersized memory allocation followed by an out-of-bounds memcpy() operation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.