Medium [CVE-2026-63926] fix tail fragment offset in bpf_msg_push_data

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpf_msg_push_data When bpf_msg_push_data() inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment.

The right fragment offset is page-local, but the code advances it with `start`, which is the message-global insertion point. For inserts into a non-first SG entry, this over-advances the offset and leaves the split layout inconsistent.

Advance the right fragment offset by the fragment-local delta, `start - offset`, which matches the length removed from the front of the original entry. When the `bpf_msg_push_data` function processes data, it incorrectly calculates the offset for data fragments, leading to an inconsistent memory arrangement.

This issue could potentially allow a local attacker to cause data corruption or system instability. This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is confined to local authenticated users and requires specific eBPF socket message programs to trigger a denial of service.

Under typical enterprise deployments, standard unprivileged accounts cannot load or attach BPF programs to socket maps, restricting the attack surface to privileged or specialized networking workloads.