CVE-2026-64354 Details
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Validate BTF repeated field counts before expansion btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD, and btf_repeat_fields() expands repeatable fields from array elements into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields(). The remaining-capacity check performs the expanded field count calculation in u32. A malformed BTF can wrap that calculation, causing the check to pass even when the expanded field count exceeds the scratch array capacity. The following memcpy() can then write past the end of the array. Use checked addition and multiplication before copying repeated fields and reject impossible counts.
A vulnerability in the Linux kernel's BPF subsystem allows for memory corruption by failing to properly validate repeated field counts in user-supplied BTF before expansion. This issue is present in the stable branch of the Linux kernel. During the BPF_BTF_LOAD process, the function that parses BTF metadata can be tricked by malformed BTF data. The vulnerability arises because the check for remaining capacity calculates the expanded field count using a 32-bit unsigned integer, which can be manipulated to exceed the actual capacity of the scratch array used for field parsing. As a result, the subsequent memory copy operation can overwrite memory boundaries, leading to potential exploitation.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version can be found on the official Linux kernel website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/b9452b594fd3aecbfd4aa0a6a1f741330a37dab7 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c5ff816d5f13900c3f1f3298cfcc61339e056e56 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cd407de2ef5dc70f1970b343ffaa16186340fdfd | kernel.org | Patch |
| https://git.kernel.org/stable/c/ff77d013b737c0f77d925e2f2c59f0cf3d76bd35 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.11.6, < 6.12 >= 6.12.1, < 6.12.96 >= 6.13, < 6.18.39 >= 6.19, < 7.1.4 6.12 - 6.12 rc4 6.12 rc5 6.12 rc6 6.12 rc7 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | Initial Analysis | [email protected] |
| Aug 17, 2026 | CVE Modified | kernel.org |
| Jul 27, 2026 | CVE Modified | kernel.org |
| Jul 25, 2026 | New CVE Received | kernel.org |