CVE-2026-64353
Description
AI Translation Available
In the Linux kernel, the following vulnerability has been resolved:
bpf: Keep dynamic inner array lookups nullable
An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its
inner map template. A concrete inner array with a different max_entries
value can then replace the template.
After a successful outer map lookup, the verifier represents the
resulting map pointer using the inner map template. Const-key lookup
nullness elision consequently uses the template max_entries even though
the runtime helper uses the concrete inner map max_entries.
Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP,
because the template max_entries does not prove that the key is in bounds
for the concrete runtime map.
https://git.kernel.org/stable/c/0b92ad64d6e4bde85e6b9888404f9a7a2b65d269
https://git.kernel.org/stable/c/53040a81ae57cdca8af8ac36fe4e661730cf7c6b
https://git.kernel.org/stable/c/d57db0d975053e01410c54e708a85b6d32ef2ebd