CVE-2026-64353 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Keep dynamic inner array lookups nullable An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its inner map template. A concrete inner array with a different max_entries value can then replace the template. After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template max_entries even though the runtime helper uses the concrete inner map max_entries. Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP, because the template max_entries does not prove that the key is in bounds for the concrete runtime map.
A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows for improper handling of inner array lookups in ARRAY_OF_MAPS. This issue arises because an array created with the BPF_F_INNER_MAP flag can be used as a template for inner maps, which can then be replaced with a concrete inner array that has a different max_entries value. The vulnerability occurs when the verifier uses the template's max_entries to determine key validity, leading to potential out-of-bounds access. The issue has been fixed in the upstream commit 53040a81ae57cdca8af8ac36fe4e661730cf7c6b.
Users should upgrade to the latest version of the Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0b92ad64d6e4bde85e6b9888404f9a7a2b65d269 | kernel.org | Patch |
| https://git.kernel.org/stable/c/53040a81ae57cdca8af8ac36fe4e661730cf7c6b | kernel.org | Patch |
| https://git.kernel.org/stable/c/d57db0d975053e01410c54e708a85b6d32ef2ebd | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.14, < 6.18.40 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |