CVE-2026-64353

Summary

In the Linux kernel, the following vulnerability has been resolved:

bpf: Keep dynamic inner array lookups nullable

An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its inner map template. A concrete inner array with a different max_entries value can then replace the template.

After a successful outer map lookup, the verifier represents the resulting map pointer using the inner map template. Const-key lookup nullness elision consequently uses the template max_entries even though the runtime helper uses the concrete inner map max_entries.

Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP, because the template max_entries does not prove that the key is in bounds for the concrete runtime map.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxd2102f2f5d75a84dbab6ff890359f0bd4a18ca22 < 0b92ad64d6e4bde85e6b9888404f9a7a2b65d269affected
LinuxLinuxd2102f2f5d75a84dbab6ff890359f0bd4a18ca22 < d57db0d975053e01410c54e708a85b6d32ef2ebdaffected
LinuxLinuxd2102f2f5d75a84dbab6ff890359f0bd4a18ca22 < 53040a81ae57cdca8af8ac36fe4e661730cf7c6baffected
LinuxLinux6.14affected
LinuxLinux0 < 6.14unaffected
LinuxLinux6.18.40 <= 6.18.*unaffected
LinuxLinux7.1.4 <= 7.1.*unaffected
LinuxLinux7.2-rc1 <= *unaffected

Weaknesses

References