{"id":"CVE-2026-63830","revision":"0e4cc40a36264a3086c29fa528e07ece","records":[{"revision":"0e4cc40a36264a3086c29fa528e07ece","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63830","aliases":[],"title":"net: skmsg: preserve sg.copy across SG transforms","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skmsg: preserve sg.copy across SG transforms\n\nThe sk_msg sg.copy bitmap is part of the scatterlist entry ownership\nstate. A set bit tells sk_msg_compute_data_pointers() not to expose the\nentry through writable BPF ctx->data. This protects entries backed by\npages that are not private to the sk_msg, such as splice-backed file\npage-cache pages.\n\nSeveral sk_msg transform paths move, copy, split, or compact\nmsg->sg.data[] entries without moving the matching sg.copy bit. This can\nmake an externally backed entry arrive at a new slot with a clear copy\nbit. A later SK_MSG verdict can then expose sg_virt(sge) as writable\nctx->data and BPF stores can modify the original page cache.\n\nKeep sg.copy synchronized with sg.data[] whenever entries are\ntransferred, shifted, split, or copied into a new sk_msg. Clear the bit\nwhen an entry is replaced by a newly allocated private page or freed.\nThis covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(),\nsk_msg_xfer(), and tls_split_open_record(), including the partial tail\nentry created during TLS open-record splitting.","state":0,"publishedAt":"2026-07-19T12:02:23.741+00:00","modifiedAt":"2026-10-19T20:07:49.188+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/skmsg.h\",\n                        \"net/core/filter.c\",\n                        \"net/core/skmsg.c\",\n                        \"net/tls/tls_sw.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"f126eed589eec6f201405abbc398844042ef6d57\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"31a110642b5fb5e61940cbcfb503445ac4f28017\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"9bb86d8184b37503816150c4a6ad3c17dfdbe827\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"0eb4c16c4adb262763bda870a8ed38a1a9dec7ec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"d22cc92bc41290e5783a72375e0843d9435f6001\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"1acdd14c0990dd1cd4b6534f00366d2e6dfce05f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d3b18ad31f93d0b6bae105c679018a1ba7daa9ca\",\n                            \"lessThan\": \"406e8a651a7b854c41fecd5117bb282b3a6c2c6b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/skmsg.h\",\n                        \"net/core/filter.c\",\n                        \"net/core/skmsg.c\",\n                        \"net/tls/tls_sw.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.20\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.261\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.212\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.177\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.144\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.95\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.38\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.3\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L","score":9.4,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/f126eed589eec6f201405abbc398844042ef6d57","https://git.kernel.org/stable/c/31a110642b5fb5e61940cbcfb503445ac4f28017","https://git.kernel.org/stable/c/9bb86d8184b37503816150c4a6ad3c17dfdbe827","https://git.kernel.org/stable/c/0eb4c16c4adb262763bda870a8ed38a1a9dec7ec","https://git.kernel.org/stable/c/d22cc92bc41290e5783a72375e0843d9435f6001","https://git.kernel.org/stable/c/1acdd14c0990dd1cd4b6534f00366d2e6dfce05f","https://git.kernel.org/stable/c/21ed9540a8e1906dfcbc1bb82ba9b4de4fa4bd6d","https://git.kernel.org/stable/c/406e8a651a7b854c41fecd5117bb282b3a6c2c6b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63830","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63830","identifiers":["CVE-2026-63830"]},"retained":false,"historicalAffected":[]}],"coverage":[]}