CVE-2026-63830

In the Linux kernel, the following vulnerability has been resolved:

net: skmsg: preserve sg.copy across SG transforms

The sk_msg sg.copy bitmap is part of the scatterlist entry ownership

state. A set bit tells skmsgcomputedatapointers() not to expose the

entry through writable BPF ctx->data. This protects entries backed by

pages that are not private to the sk_msg, such as splice-backed file

page-cache pages.

Several sk_msg transform paths move, copy, split, or compact

msg->sg.data[] entries without moving the matching sg.copy bit. This can

make an externally backed entry arrive at a new slot with a clear copy

bit. A later SKMSG verdict can then expose sgvirt(sge) as writable

ctx->data and BPF stores can modify the original page cache.

Keep sg.copy synchronized with sg.data[] whenever entries are

transferred, shifted, split, or copied into a new sk_msg. Clear the bit

when an entry is replaced by a newly allocated private page or freed.

This covers the BPF pull/push/pop helpers, skmsgshift_left/right(),

skmsgxfer(), and tlssplitopen_record(), including the partial tail

entry created during TLS open-record splitting.