The Linux kernel contained a vulnerability in the bpf_msg_push_data() function used in BPF sockmap operations. When the scatterlist ring buffer is full or nearly full, the function falls back to a copy path that calculates the allocation size by summing copy and len, both 32-bit unsigned integers. A maliciously crafted len value can cause this sum to overflow, resulting in an undersized allocation. This leads to an out-of-bounds memcpy operation, causing memory corruption and kernel crashes (as indicated by KASAN reports). The vulnerability is identified as CVE-2026-64548 and has been fixed by introducing an overflow check prior to allocation.

Successful exploitation can lead to out-of-bounds memory writes in kernel space, causing system instability, crashes (kernel oops), and potentially allowing an attacker to execute arbitrary code with kernel privileges. The CVSS 3.1 vector rates this vulnerability as high severity with high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

A fix is available that adds an overflow check before memory allocation in the affected function. Users should apply the official Linux kernel patches that address CVE-2026-64548. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No alternative mitigations or workarounds are indicated.