CVE-2026-74256

A flaw was found in the Linux kernel, specifically within its BPF (Berkeley Packet Filter) and sockmap features. This vulnerability is due to an integer overflow in the bpf_msg_pop_data() function, where certain calculations can incorrectly wrap around. An attacker with local access could exploit this by providing malicious input, leading to a kernel crash and causing a Denial of Service (DoS) on the affected system.

An integer overflow in bpf_msg_pop_data can make the bounds check accept an out of range start and len pair because start plus len was evaluated in 32 bit before being stored in a u64. A BPF sockmap program can then drive the pop loop past the end of the scatterlist and reach sk_msg_shift_left with an invalid or empty sg slot, which can trigger put_page on invalid state and crash the kernel. For the CVSS the PR:L is used in the paranoid score because BPF and network capabilities may be delegated to a local user, service account, or container in practical deployments. The issue is not directly network reachable without the ability to load or run the relevant BPF sockmap program. Impact is at least local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to scatterlist out of bounds traversal and page reference handling corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.