CVE-2026-64354

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf: Validate BTF repeated field counts before expansion<br /> <br /> btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD,<br /> and btf_repeat_fields() expands repeatable fields from array elements<br /> into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields().<br /> <br /> The remaining-capacity check performs the expanded field count calculation<br /> in u32. A malformed BTF can wrap that calculation, causing the check to<br /> pass even when the expanded field count exceeds the scratch array<br /> capacity. The following memcpy() can then write past the end of the<br /> array.<br /> <br /> Use checked addition and multiplication before copying repeated fields<br /> and reject impossible counts.