CVE-2026-64353

In the Linux kernel, the following vulnerability has been resolved:

bpf: Keep dynamic inner array lookups nullable

An ARRAY_OF_MAPS can use an array created with BPF_F_INNER_MAP as its

inner map template. A concrete inner array with a different max_entries

value can then replace the template.

After a successful outer map lookup, the verifier represents the

resulting map pointer using the inner map template. Const-key lookup

nullness elision consequently uses the template max_entries even though

the runtime helper uses the concrete inner map max_entries.

Do not elide lookup result nullness for maps marked with BPF_F_INNER_MAP,

because the template max_entries does not prove that the key is in bounds

for the concrete runtime map.