CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: reject overflowing copy + len in bpfmsgpush_data()

When the scatterlist ring is full or nearly full, bpfmsgpushdata() enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from BPF with arg3type = ARG_ANYTHING and both are u32, a crafted len can wrap the sum to a small value, causing an undersized allocation followed by an out-of-bounds memcpy.

BUG: unable to handle page fault for address: ffffed104089a402 Oops: Oops: 0000 [#1] SMP KASAN NOPTI Call Trace: __asanmemcpy (mm/kasan/shadow.c:105) bpfmsg_pushdata (net/core/filter.c:2852 net/core/filter.c:2788) bpfprog9ed8b5711920a7d7+0x2e/0x36 skpsockmsgverdict (net/core/skmsg.c:934) tcpbpfsendmsg (net/ipv4/tcpbpf.c:421 net/ipv4/tcpbpf.c:584) _syssendto (net/socket.c:2206) dosyscall64 (arch/x86/entry/syscall64.c:94) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:130)

Add an overflow check before the allocation.