Tracker / CVE-2026-63830
CVE-2026-63830
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.
Affected products and versions
| linux | linux_kernel · 4.20 → 5.10.261 |
|---|---|
| linux | linux_kernel · 5.11 → 5.15.212 |
| linux | linux_kernel · 5.16 → 6.1.177 |
| linux | linux_kernel · 6.13 → 6.18.38 |
| linux | linux_kernel · 6.19 → 7.1.3 |
| linux | linux_kernel · 6.2 → 6.6.144 |
| linux | linux_kernel · 6.7 → 6.12.95 |