EUVD-2026-59403
GHSA-5w87-22m9-4mhm
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Loading BPF sockmap programs requires CAP_BPF or CAP_NET_ADMIN, making PR:N incorrect; PR:L reflects the necessary elevated local capability.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
start and len are u32, so
u64 last = start + len;
evaluates start + len in 32-bit and wraps before storing it in last. The bounds check
if (start >= offset + l || last > msg->sg.size) return -EINVAL;
can then be passed with an out-of-range start/len, after which the pop loop runs off the end of the scatterlist and sk_msg_shift_left() calls put_page() on the empty msg->sg.end slot:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline] RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline] RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984 Call Trace: <TASK> bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8 bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746 sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934 tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline] tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583 __sock_sendmsg+0x153/0x1c0 net/socket.c:802 __sys_sendto+0x326/0x430 net/socket.c:2265 __x64_sys_sendto+0xe3/0x100 net/socket.c:2268 do_syscall_64+0x14c/0x480 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK>
Widen the addition with a (u64) cast so the bound is evaluated in 64-bit and a len near U32_MAX no longer wraps below msg->sg.size.
While here, change pop from int to u32. It counts bytes against the unsigned scatterlist lengths and can never be negative, so the signed type only invites sign-confusion in the pop loop.
AnalysisAI
Integer overflow in the Linux kernel's BPF sockmap helper bpf_msg_pop_data() enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user with `CAP_BPF` or `CAP_NET_ADMIN` capability - on most modern Linux distributions, `kernel.unprivileged_bpf_disabled=1` is set by default (e.g., Ubuntu 20.04+, Fedora, RHEL 8+), meaning unprivileged users cannot load BPF programs at all and are not exposed to this code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector `AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` scores 8.4 (High), but `PR:N` is inconsistent with the exploitation path - loading BPF sockmap programs requires `CAP_BPF` or `CAP_NET_ADMIN`, capabilities not available to ordinary unprivileged users on hardened modern distributions; this overstates exploitability and inflates the base score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with `CAP_BPF` or `CAP_NET_ADMIN` loads a crafted BPF sockmap program that calls `bpf_msg_pop_data()` with `start` and `len` values near `U32_MAX`, such that their 32-bit sum wraps to a value smaller than the scatterlist size, bypassing the bounds check. When a process sends data over the BPF-attached TCP socket, the program fires, the pop loop walks off the end of `msg->sg`, and `sk_msg_shift_left()` calls `put_page()` on a null or garbage page pointer - crashing the kernel with a general protection fault. … |
| Remediation | The primary remediation is upgrading to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 - all of which contain the fix commit that adds a `(u64)` cast to `start + len`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployed systems running Linux kernel versions 5.10, 5.15, 6.1, 6.6, 7.1, or pre-7.2 and confirm patch availability from your distribution vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a p
Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitra
An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsin
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfi
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers fo
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud meta
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, crea
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth gran
Same technique Buffer Overflow
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today