CVE-2026-64353

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier. This vulnerability occurs because the BPF verifier incorrectly handles dynamic inner array lookups in ARRAY_OF_MAPS. When an inner map template is replaced by a concrete inner array with a different maximum entry size, the verifier may perform incorrect bounds checking. A local attacker could exploit this flaw by creating a specially crafted BPF program, potentially leading to out-of-bounds memory access. This could result in a denial of service or, in some cases, privilege escalation.

This vulnerability is rated as Moderate severity because exploitation requires local access and elevated capabilities to load BPF programs, as unprivileged BPF is disabled by default in Red Hat Enterprise Linux. In typical deployments, an attacker must already hold administrative privileges or CAP_BPF to interact with the affected inner map logic. While an incorrect verifier bounds calculation can trigger an out-of-bounds access causing a kernel crash or potential privilege escalation, the requirement for existing privileges significantly limits untrusted exposure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.