CVE-2026-74256

CVE CVE-2026-74256EUVD EUVD-2026-59403Published 2026-08-15T05:57:34.000ZLast changed 2026-08-17T05:45:05.000ZCVSS 8.4

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if (start >= offset + l || last > msg->sg.size) return -EINVAL; can then be passed with an out-of-range start/len, after which the pop loop runs off the end of the scatterlist and sk_msg_shift_left() calls put_page() on the empty msg->sg.end slot: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline] RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline] RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984 Call Trace: <TASK> bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8 bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746 sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934 tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline] tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583 __sock_sendmsg+0x153/0x1c0 net/socket.c:802 __sys_sendto+0x326/0x430 net/socket.c:2265 __x64_sys_sendto+0xe3/0x100 net/socket.c:2268 do_syscall_64+0x14c/0x480 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Widen the addition with a (u64) cast so the bound is evaluated in 64-bit and a len near U32_MAX no longer wraps below msg->sg.size. While here, change pop from int to u32. It counts bytes against the unsigned scatterlist lengths and can never be negative, so the signed type only invites sign-confusion in the pop loop.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 5.10.261; patch: 6.1.178; 5.0; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <e09f7bd7273928b4089e6b71f8e992f2b356ca1b; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <17eb9832a10db2f7a80cb429ca2bc5038445a943; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <c05a0ec1cdced622a1a0c7d85679fe02f31033ec; patch: 0; patch: 6.6.145; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <fe09dd288722f1c749b7506c0b3e7841a7d85027; patch: 7.1.5; patch: 6.18.40; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <9ef44ed6fb0c1db01cfcc3de432a33e719713eb5; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <a48802fb2cd2d1e23651989f8ff4d15e9d5dad54; patch: 6.12.97; patch: 7.2; patch: 5.15.212; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0; 7246d8ed4dcce23f7509949a77be15fa9f0e3d28 <ba5cc05dae8fce237d191c7ea96b1107a791e548

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.