{"id":7186,"date":"2026-09-04T18:49:27","date_gmt":"2026-09-04T10:49:27","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74256"},"modified":"2026-09-04T18:49:27","modified_gmt":"2026-09-04T10:49:27","slug":"cve-2026-74256","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74256","title":{"rendered":"CVE-2026-74256 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: fix int"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check<\/p>\n<p>start and len are u32, so<\/p>\n<p>\tu64 last = start + len;<\/p>\n<p>evaluates start + len in 32-bit and wraps before storing it in last.<br \/>\nThe bounds check<\/p>\n<p>\tif (start &gt;= offset + l || last &gt; msg-&gt;sg.size)<br \/>\n\t\treturn -EINVAL;<\/p>\n<p>can then be passed with an out-of-range start\/len, after which the pop<br \/>\nloop runs off the end of the scatterlist and sk_msg_shift_left() calls<br \/>\nput_page() on the empty msg-&gt;sg.end slot:<\/p>\n<p>  Oops: general protection fault, probably for non-canonical address<br \/>\n  0xdffffc0000000001: 0000 [#1] SMP KASAN PTI<br \/>\n  KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]<br \/>\n  RIP: 0010:sk_msg_shift_left net\/core\/filter.c:2957 [inline]<br \/>\n  RIP: 0010:____bpf_msg_pop_data net\/core\/filter.c:3103 [inline]<br \/>\n  RIP: 0010:bpf_msg_pop_data+0x753\/0x1a10 net\/core\/filter.c:2984<br \/>\n  Call Trace:<\/p>\n<p>   bpf_prog_4cc92c278f4d5d56+0x1b1\/0x1e8<br \/>\n   bpf_prog_run_pin_on_cpu+0x107\/0x320 include\/linux\/filter.h:746<br \/>\n   sk_psock_msg_verdict+0x357\/0x7f0 net\/core\/skmsg.c:934<br \/>\n   tcp_bpf_send_verdict net\/ipv4\/tcp_bpf.c:420 [inline]<br \/>\n   tcp_bpf_sendmsg+0x766\/0x1ae0 net\/ipv4\/tcp_bpf.c:583<br \/>\n   __sock_sendmsg+0x153\/0x1c0 net\/socket.c:802<br \/>\n   __sys_sendto+0x326\/0x430 net\/socket.c:2265<br \/>\n   __x64_sys_sendto+0xe3\/0x100 net\/socket.c:2268<br \/>\n   do_syscall_64+0x14c\/0x480<br \/>\n   entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n<p>Widen the addition with a (u64) cast so the bound is evaluated in<br \/>\n64-bit and a len near U32_MAX no longer wraps below msg-&gt;sg.size.<\/p>\n<p>While here, change pop from int to u32. It counts bytes against the<br \/>\nunsigned scatterlist lengths and can never be negative, so the signed<br \/>\ntype only invites sign-confusion in the pop loop.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check<\/p>\n<p>start and len are u32, so<\/p>\n<p>\tu64 last = start + len;<\/p>\n<p>evaluat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7186","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7186","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7186"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7186"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7186"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}