Linux Kernel CVE-2026-63926

The flaw lives in the eBPF sockmap/sk_msg data path (net/core/filter.c), which lets BPF programs attached to sockets rewrite message payloads in flight. Messages are represented as scatterlist (SG) arrays of page fragments. bpf_msg_push_data() inserts bytes mid-message by splitting a single SG entry into a left and a right fragment; the right fragment's page-local offset must be advanced only by the number of bytes removed from the front of the original entry (start - offset). The buggy code advanced it by 'start', the message-global insertion index, which for any insert into a non-first SG entry over-advances the offset and leaves the fragment pointing outside its intended region. This is an improper-offset / out-of-bounds class defect (akin to CWE-125/CWE-787); the CWE field was not populated in the source data (N/A). CPE data identifies the affected component generically as cpe:2.3:a:linux:linux, i.e. the mainline kernel rather than a specific distribution build.