CVE-2026-74256

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74256", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.876Z", "datePublished": "2026-08-15T05:57:34.956Z", "dateUpdated": "2026-10-16T18:55:28.085Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:05.356Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check\n\nstart and len are u32, so\n\n\tu64 last = start + len;\n\nevaluates start + len in 32-bit and wraps before storing it in last.\nThe bounds check\n\n\tif (start >= offset + l || last > msg->sg.size)\n\t\treturn -EINVAL;\n\ncan then be passed with an out-of-range start/len, after which the pop\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls\nput_page() on the empty msg->sg.end slot:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]\n RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]\n RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984\n Call Trace:\n <TASK>\n bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8\n bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746\n sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934\n tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]\n tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583\n __sock_sendmsg+0x153/0x1c0 net/socket.c:802\n __sys_sendto+0x326/0x430 net/socket.c:2265\n __x64_sys_sendto+0xe3/0x100 net/socket.c:2268\n do_syscall_64+0x14c/0x480\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nWiden the addition with a (u64) cast so the bound is evaluated in\n64-bit and a len near U32_MAX no longer wraps below msg->sg.size.\n\nWhile here, change pop from int to u32. It counts bytes against the\nunsigned scatterlist lengths and can never be negative, so the signed\ntype only invites sign-confusion in the pop loop."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is in the BPF sk_msg helper bpf_msg_pop_data(), reached only from the sockmap egress verdict path via local sendmsg/sendto on a sockmap- or kTLS-attached socket (tcp_bpf_sendmsg/tls_sw_sendmsg \u2192 sk_psock_msg_verdict), matching kernel CNA BPF/sockmap Local guidance.\nAC:L - start and len are ARG_ANYTHING (verifier unbounded); an sk_msg program can pick values whose u32 sum wraps below msg->sg.size (e.g. start=100, len\u2248U32_MAX) and trigger the bad path deterministically with a single sendmsg, with no race or external state.\nPR:N - Triggering corruption requires only sendmsg on a socket already in a sockmap whose SK_MSG program calls bpf_msg_pop_data; on internet-facing kTLS/sockmap L7 proxies an unauthenticated remote client can reach this with no victim credentials, and arg2/arg3 are unconstrained by the verifier.\nUI:N - Exploitation needs only the attacker's own socket traffic and BPF-driven pop parameters; no independent victim mount, file open, or administrator action is required at trigger time.\nS:U - Out-of-bounds scatterlist manipulation corrupts kernel sk_msg/page state within the same kernel security authority and does not by itself cross VM, IOMMU, or hypervisor boundaries.\nC:H - After the overflowed bound check, sk_msg_shift_left() walks past msg->sg.end, reading invalid scatterlist slots and dereferencing bogus page pointers via put_page(), yielding out-of-bounds kernel memory disclosure convertible to arbitrary read.\nI:H - The same over-run writes msg->sg.data[] entries and copy bitmap state beyond the fixed MAX_MSG_FRAGS ring, corrupting adjacent kernel objects with attacker-influenced scatterlist metadata suitable for control-flow hijack and privilege escalation.\nA:H - The fix commit's KASAN trace shows a general protection fault/null-ptr-deref in sk_msg_shift_left() during bpf_msg_pop_data(); this reliably oopses the host and can panic even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "9ef44ed6fb0c1db01cfcc3de432a33e719713eb5", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "ba5cc05dae8fce237d191c7ea96b1107a791e548", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "c05a0ec1cdced622a1a0c7d85679fe02f31033ec", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "17eb9832a10db2f7a80cb429ca2bc5038445a943", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "fe09dd288722f1c749b7506c0b3e7841a7d85027", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "e09f7bd7273928b4089e6b71f8e992f2b356ca1b", "status": "affected", "versionType": "git"}, {"version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "a48802fb2cd2d1e23651989f8ff4d15e9d5dad54", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/filter.c"], "versions": [{"version": "5.0", "status": "affected"}, {"version": "0", "lessThan": "5.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.0", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/9ef44ed6fb0c1db01cfcc3de432a33e719713eb5"}, {"url": "https://git.kernel.org/stable/c/d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0"}, {"url": "https://git.kernel.org/stable/c/ba5cc05dae8fce237d191c7ea96b1107a791e548"}, {"url": "https://git.kernel.org/stable/c/c05a0ec1cdced622a1a0c7d85679fe02f31033ec"}, {"url": "https://git.kernel.org/stable/c/17eb9832a10db2f7a80cb429ca2bc5038445a943"}, {"url": "https://git.kernel.org/stable/c/fe09dd288722f1c749b7506c0b3e7841a7d85027"}, {"url": "https://git.kernel.org/stable/c/e09f7bd7273928b4089e6b71f8e992f2b356ca1b"}, {"url": "https://git.kernel.org/stable/c/a48802fb2cd2d1e23651989f8ff4d15e9d5dad54"}], "title": "bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74256", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:51:25.562795Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:28.085Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74256", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:51:25.562795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:51:26.527Z"}}], "cna": {"title": "bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The flaw is in the BPF sk_msg helper bpf_msg_pop_data(), reached only from the sockmap egress verdict path via local sendmsg/sendto on a sockmap- or kTLS-attached socket (tcp_bpf_sendmsg/tls_sw_sendmsg \u2192 sk_psock_msg_verdict), matching kernel CNA BPF/sockmap Local guidance.\nAC:L - start and len are ARG_ANYTHING (verifier unbounded); an sk_msg program can pick values whose u32 sum wraps below msg->sg.size (e.g. start=100, len\u2248U32_MAX) and trigger the bad path deterministically with a single sendmsg, with no race or external state.\nPR:N - Triggering corruption requires only sendmsg on a socket already in a sockmap whose SK_MSG program calls bpf_msg_pop_data; on internet-facing kTLS/sockmap L7 proxies an unauthenticated remote client can reach this with no victim credentials, and arg2/arg3 are unconstrained by the verifier.\nUI:N - Exploitation needs only the attacker's own socket traffic and BPF-driven pop parameters; no independent victim mount, file open, or administrator action is required at trigger time.\nS:U - Out-of-bounds scatterlist manipulation corrupts kernel sk_msg/page state within the same kernel security authority and does not by itself cross VM, IOMMU, or hypervisor boundaries.\nC:H - After the overflowed bound check, sk_msg_shift_left() walks past msg->sg.end, reading invalid scatterlist slots and dereferencing bogus page pointers via put_page(), yielding out-of-bounds kernel memory disclosure convertible to arbitrary read.\nI:H - The same over-run writes msg->sg.data[] entries and copy bitmap state beyond the fixed MAX_MSG_FRAGS ring, corrupting adjacent kernel objects with attacker-influenced scatterlist metadata suitable for control-flow hijack and privilege escalation.\nA:H - The fix commit's KASAN trace shows a general protection fault/null-ptr-deref in sk_msg_shift_left() during bpf_msg_pop_data(); this reliably oopses the host and can panic even when full exploitation is not attempted."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "9ef44ed6fb0c1db01cfcc3de432a33e719713eb5", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "ba5cc05dae8fce237d191c7ea96b1107a791e548", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "c05a0ec1cdced622a1a0c7d85679fe02f31033ec", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "17eb9832a10db2f7a80cb429ca2bc5038445a943", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "fe09dd288722f1c749b7506c0b3e7841a7d85027", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "e09f7bd7273928b4089e6b71f8e992f2b356ca1b", "versionType": "git"}, {"status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "lessThan": "a48802fb2cd2d1e23651989f8ff4d15e9d5dad54", "versionType": "git"}], "programFiles": ["net/core/filter.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"status": "unaffected", "version": "0", "lessThan": "5.0", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/filter.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/9ef44ed6fb0c1db01cfcc3de432a33e719713eb5"}, {"url": "https://git.kernel.org/stable/c/d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0"}, {"url": "https://git.kernel.org/stable/c/ba5cc05dae8fce237d191c7ea96b1107a791e548"}, {"url": "https://git.kernel.org/stable/c/c05a0ec1cdced622a1a0c7d85679fe02f31033ec"}, {"url": "https://git.kernel.org/stable/c/17eb9832a10db2f7a80cb429ca2bc5038445a943"}, {"url": "https://git.kernel.org/stable/c/fe09dd288722f1c749b7506c0b3e7841a7d85027"}, {"url": "https://git.kernel.org/stable/c/e09f7bd7273928b4089e6b71f8e992f2b356ca1b"}, {"url": "https://git.kernel.org/stable/c/a48802fb2cd2d1e23651989f8ff4d15e9d5dad54"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check\n\nstart and len are u32, so\n\n\tu64 last = start + len;\n\nevaluates start + len in 32-bit and wraps before storing it in last.\nThe bounds check\n\n\tif (start >= offset + l || last > msg->sg.size)\n\t\treturn -EINVAL;\n\ncan then be passed with an out-of-range start/len, after which the pop\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls\nput_page() on the empty msg->sg.end slot:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]\n RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]\n RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984\n Call Trace:\n <TASK>\n bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8\n bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746\n sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934\n tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]\n tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583\n __sock_sendmsg+0x153/0x1c0 net/socket.c:802\n __sys_sendto+0x326/0x430 net/socket.c:2265\n __x64_sys_sendto+0xe3/0x100 net/socket.c:2268\n do_syscall_64+0x14c/0x480\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nWiden the addition with a (u64) cast so the bound is evaluated in\n64-bit and a len near U32_MAX no longer wraps below msg->sg.size.\n\nWhile here, change pop from int to u32. It counts bytes against the\nunsigned scatterlist lengths and can never be negative, so the signed\ntype only invites sign-confusion in the pop loop."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.0"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:45:05.356Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74256", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:28.085Z", "dateReserved": "2026-08-15T05:44:03.876Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:57:34.956Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "9ef44ed6fb0c1db01cfcc3de432a33e719713eb5", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "ba5cc05dae8fce237d191c7ea96b1107a791e548", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "c05a0ec1cdced622a1a0c7d85679fe02f31033ec", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "17eb9832a10db2f7a80cb429ca2bc5038445a943", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "fe09dd288722f1c749b7506c0b3e7841a7d85027", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "e09f7bd7273928b4089e6b71f8e992f2b356ca1b", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}, {"lessThan": "a48802fb2cd2d1e23651989f8ff4d15e9d5dad54", "status": "affected", "version": "7246d8ed4dcce23f7509949a77be15fa9f0e3d28", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/filter.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.0"}, {"lessThan": "5.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check\n\nstart and len are u32, so\n\n\tu64 last = start + len;\n\nevaluates start + len in 32-bit and wraps before storing it in last.\nThe bounds check\n\n\tif (start >= offset + l || last > msg->sg.size)\n\t\treturn -EINVAL;\n\ncan then be passed with an out-of-range start/len, after which the pop\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls\nput_page() on the empty msg->sg.end slot:\n\n Oops: general protection fault, probably for non-canonical address\n 0xdffffc0000000001: 0000 [#1] SMP KASAN PTI\n KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n RIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]\n RIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]\n RIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984\n Call Trace:\n <TASK>\n bpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8\n bpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746\n sk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934\n tcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]\n tcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583\n __sock_sendmsg+0x153/0x1c0 net/socket.c:802\n __sys_sendto+0x326/0x430 net/socket.c:2265\n __x64_sys_sendto+0xe3/0x100 net/socket.c:2268\n do_syscall_64+0x14c/0x480\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nWiden the addition with a (u64) cast so the bound is evaluated in\n64-bit and a len near U32_MAX no longer wraps below msg->sg.size.\n\nWhile here, change pop from int to u32. It counts bytes against the\nunsigned scatterlist lengths and can never be negative, so the signed\ntype only invites sign-confusion in the pop loop."}], "id": "CVE-2026-74256", "lastModified": "2026-10-16T19:17:34.317", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74256", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:51:25.562795Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:24.743", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17eb9832a10db2f7a80cb429ca2bc5038445a943"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ef44ed6fb0c1db01cfcc3de432a33e719713eb5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a48802fb2cd2d1e23651989f8ff4d15e9d5dad54"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ba5cc05dae8fce237d191c7ea96b1107a791e548"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c05a0ec1cdced622a1a0c7d85679fe02f31033ec"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e09f7bd7273928b4089e6b71f8e992f2b356ca1b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe09dd288722f1c749b7506c0b3e7841a7d85027"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check", "id": "2516834", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516834"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check\nstart and len are u32, so\nu64 last = start + len;\nevaluates start + len in 32-bit and wraps before storing it in last.\nThe bounds check\nif (start >= offset + l || last > msg->sg.size)\nreturn -EINVAL;\ncan then be passed with an out-of-range start/len, after which the pop\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls\nput_page() on the empty msg->sg.end slot:\nOops: general protection fault, probably for non-canonical address\n0xdffffc0000000001: 0000 [#1] SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nRIP: 0010:sk_msg_shift_left net/core/filter.c:2957 [inline]\nRIP: 0010:____bpf_msg_pop_data net/core/filter.c:3103 [inline]\nRIP: 0010:bpf_msg_pop_data+0x753/0x1a10 net/core/filter.c:2984\nCall Trace:\n<TASK>\nbpf_prog_4cc92c278f4d5d56+0x1b1/0x1e8\nbpf_prog_run_pin_on_cpu+0x107/0x320 include/linux/filter.h:746\nsk_psock_msg_verdict+0x357/0x7f0 net/core/skmsg.c:934\ntcp_bpf_send_verdict net/ipv4/tcp_bpf.c:420 [inline]\ntcp_bpf_sendmsg+0x766/0x1ae0 net/ipv4/tcp_bpf.c:583\n__sock_sendmsg+0x153/0x1c0 net/socket.c:802\n__sys_sendto+0x326/0x430 net/socket.c:2265\n__x64_sys_sendto+0xe3/0x100 net/socket.c:2268\ndo_syscall_64+0x14c/0x480\nentry_SYSCALL_64_after_hwframe+0x77/0x7f\n</TASK>\nWiden the addition with a (u64) cast so the bound is evaluated in\n64-bit and a len near U32_MAX no longer wraps below msg->sg.size.\nWhile here, change pop from int to u32. It counts bytes against the\nunsigned scatterlist lengths and can never be negative, so the signed\ntype only invites sign-confusion in the pop loop.", "A flaw was found in the Linux kernel, specifically within its BPF (Berkeley Packet Filter) and sockmap features. This vulnerability is due to an integer overflow in the `bpf_msg_pop_data()` function, where certain calculations can incorrectly wrap around. An attacker with local access could exploit this by providing malicious input, leading to a kernel crash and causing a Denial of Service (DoS) on the affected system."], "name": "CVE-2026-74256", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74256\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74256\nhttps://lore.kernel.org/linux-cve-announce/2026081541-CVE-2026-74256-a6a4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,9ef44ed6fb0c1db01cfcc3de432a33e719713eb5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,d693c5ed67dabe1ccbf8dcea93075bdc9ffd4ca0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,ba5cc05dae8fce237d191c7ea96b1107a791e548)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,c05a0ec1cdced622a1a0c7d85679fe02f31033ec)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,17eb9832a10db2f7a80cb429ca2bc5038445a943)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,fe09dd288722f1c749b7506c0b3e7841a7d85027)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,e09f7bd7273928b4089e6b71f8e992f2b356ca1b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[7246d8ed4dcce23f7509949a77be15fa9f0e3d28,a48802fb2cd2d1e23651989f8ff4d15e9d5dad54)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.0,5.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:30:12.329526+00:00", "updated": "2026-08-22T04:45:03.425071+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}