bpf sockmap PushData OOB

Vulnerability analysis

The bug is in bpf_msg_push_data() in net/core/filter.c. When inserting data into the middle of a scatterlist entry that is not the first entry in the message, the code splits the original entry into a left fragment (psge) and a right fragment (rsge). The right fragment's page-local offset should be advanced by the fragment-local delta (start - offset), where offset is the cumulative byte position at the start of the current SG entry. Instead, the code incorrectly advances rsge.offset by the message-global insertion point `start`, which over-advances the offset by `offset` bytes for any non-first SG entry. This produces an inconsistent scatterlist layout where the right fragment points to the wrong location within its page, potentially causing out-of-bounds reads or writes when the corrupted scatterlist is subsequently processed. The fix changes `rsge.offset += start` to `rsge.offset += start - offset`, using the correct fragment-local delta. The attack surface requires a local user to load and attach a BPF sk_msg program that calls bpf_msg_push_data() with an insertion point in a non-first scatterlist entry, which requires CAP_BPF or equivalent privilege. Exploitation requires heap grooming to turn the offset corruption into a controlled write primitive, making AC:High appropriate.