CVE-2026-64353

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Keep dynamic inner array lookups nullable<br /> <br /> An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its<br /> inner map template. A concrete inner array with a different max_entries<br /> value can then replace the template.<br /> <br /> After a successful outer map lookup, the verifier represents the<br /> resulting map pointer using the inner map template. Const-key lookup<br /> nullness elision consequently uses the template max_entries even though<br /> the runtime helper uses the concrete inner map max_entries.<br /> <br /> Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP,<br /> because the template max_entries does not prove that the key is in bounds<br /> for the concrete runtime map.