CVE-2026-64354
Gravedad CVSS v3.1:
ALTA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
25/07/2026
Última modificación:
27/07/2026
Descripción
*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
bpf: Validate BTF repeated field counts before expansion<br />
<br />
btf_parse_struct_metas() walks user-supplied BTF during BPF_BTF_LOAD,<br />
and btf_repeat_fields() expands repeatable fields from array elements<br />
into the fixed BTF_FIELDS_MAX scratch array used by btf_parse_fields().<br />
<br />
The remaining-capacity check performs the expanded field count calculation<br />
in u32. A malformed BTF can wrap that calculation, causing the check to<br />
pass even when the expanded field count exceeds the scratch array<br />
capacity. The following memcpy() can then write past the end of the<br />
array.<br />
<br />
Use checked addition and multiplication before copying repeated fields<br />
and reject impossible counts.
Impacto
Puntuación base 3.x
7.80
Gravedad 3.x
ALTA