CVE-2026-63830

A flaw was found in the Linux kernel's sk_msg networking component. This vulnerability arises when the sg.copy bitmap, which controls memory access permissions, is not properly maintained during data transformations. This can allow a local attacker to bypass memory protection mechanisms, enabling them to modify sensitive kernel memory. The consequence is a potential for information disclosure or privilege escalation.

Red Hat Product Security rates this flaw as IMPORTANT for the Linux kernel packages shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt components) and Red Hat In-Vehicle OS 2. The kernel's sk_msg (sockmap) subsystem uses the sg.copy bitmap to mark scatterlist entries that are not backed by pages private to the sk_msg, such as splice-backed file page-cache pages, so that they are not exposed as writable through BPF ctx->data. Several sk_msg transform paths - including the BPF message pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record() - move, copy, split, or compact msg->sg.data[] entries without transferring the matching sg.copy bit. As a result, an externally backed entry can arrive at a new slot with a clear copy bit, and a later SK_MSG verdict can then expose that memory as writable ctx->data, allowing BPF stores to modify the original page cache or other sensitive kernel memory. A local low-privileged attacker able to exercise these code paths could exploit this to bypass memory protection mechanisms, potentially resulting in information disclosure, privilege escalation, or system instability. Red Hat Enterprise Linux 7 is listed as not affected because the vulnerable code is not present in that release. Red Hat's severity (CVSS 7.0, CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is lower than the CVSS 9.4 CRITICAL score published by CVE.org; the difference reflects the local attack vector, high attack complexity, and privileges required for exploitation. Fixes for the affected products are being pursued through the delegated resolution process.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.