In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is… (CVE-2026-63830)
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-63830) in the Linux kernel's networking subsystem relates to the sk_msg scatterlist (sg) copy bitmap, which indicates ownership of scatterlist entries to prevent writable exposure of non-private pages to BPF contexts. Several sk_msg transform paths failed to move or update the sg.copy bit correctly when entries were moved, copied, split, or compacted. This desynchronization could lead to externally backed entries being exposed as writable through BPF, enabling modification of original page cache pages. The patch synchronizes the sg.copy bitmap with sg.data[] entries during all relevant sk_msg operations, including BPF helpers and TLS record splitting, preventing unauthorized writable exposure.
Potential Impact
If exploited, this vulnerability could allow a BPF program to write to memory pages that are not private to the sk_msg, such as file page cache pages, potentially leading to unauthorized modification of kernel memory or cached file data. This could compromise system integrity or data confidentiality. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel to properly synchronize the sg.copy bitmap with scatterlist entries during all sk_msg transformations. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated here; check the vendor or Linux kernel advisories for the specific fixed kernel versions and apply updates accordingly.
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is… (CVE-2026-63830)
Description
In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The sk_msg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells sk_msg_compute_data_pointers() not to expose the entry through writable BPF ctx->data. This protects entries backed by pages that are not private to the sk_msg, such as splice-backed file page-cache pages. Several sk_msg transform paths move, copy, split, or compact msg->sg.data[] entries without moving the matching sg.copy bit. This can make an externally backed entry arrive at a new slot with a clear copy bit. A later SK_MSG verdict can then expose sg_virt(sge) as writable ctx->data and BPF stores can modify the original page cache. Keep sg.copy synchronized with sg.data[] whenever entries are transferred, shifted, split, or copied into a new sk_msg. Clear the bit when an entry is replaced by a newly allocated private page or freed. This covers the BPF pull/push/pop helpers, sk_msg_shift_left/right(), sk_msg_xfer(), and tls_split_open_record(), including the partial tail entry created during TLS open-record splitting.
CVSS v3.1
Score 9.4critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-63830) in the Linux kernel's networking subsystem relates to the sk_msg scatterlist (sg) copy bitmap, which indicates ownership of scatterlist entries to prevent writable exposure of non-private pages to BPF contexts. Several sk_msg transform paths failed to move or update the sg.copy bit correctly when entries were moved, copied, split, or compacted. This desynchronization could lead to externally backed entries being exposed as writable through BPF, enabling modification of original page cache pages. The patch synchronizes the sg.copy bitmap with sg.data[] entries during all relevant sk_msg operations, including BPF helpers and TLS record splitting, preventing unauthorized writable exposure.
Potential Impact
If exploited, this vulnerability could allow a BPF program to write to memory pages that are not private to the sk_msg, such as file page cache pages, potentially leading to unauthorized modification of kernel memory or cached file data. This could compromise system integrity or data confidentiality. However, no known exploits in the wild have been reported.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel to properly synchronize the sg.copy bitmap with scatterlist entries during all sk_msg transformations. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated here; check the vendor or Linux kernel advisories for the specific fixed kernel versions and apply updates accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-82mh-rf6q-rhp7
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63830"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27ad2a4a8d598913127c
Added to database: 07/19/2026, 19:38:21 UTC
Last enriched: 07/19/2026, 20:18:37 UTC
Last updated: 09/02/2026, 10:52:10 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.