A newly disclosed flaw in the Linux kernel can let BPF programs write to file-backed memory they were never meant to touch. For anyone running WSL 2 on Windows 10 or 11, that bug lives right inside the subsystem’s managed virtual machine. The fix is already in stable kernel trees, and Microsoft’s own WSL release channel is expected to pick it up. Waiting isn’t a good idea.
The vulnerability, catalogued as CVE-2026-63830, landed in the National Vulnerability Database on July 19, 2026. It centers on a metadata-keeping failure in the kernel’s BPF socket-message layer. The consequence: a BPF verdict can expose pages backed by the file page cache — memory shared with a file on disk — as writable data to an eBPF program. Once written, the file’s cached data changes. Integrity is gone.
Microsoft’s Security Response Center has published its own advisory, making clear this is a Linux problem, not a Windows kernel one. Windows applications running on the host are unaffected. The immediate Windows-side concern is WSL 2 and any Linux virtual machines or containers running on a Windows host or adjacent infrastructure.
The Bug: A Scatter-Gather Ownership Tag Goes Missing
The kernel’s sk_msg machinery helps BPF programs process socket messages. It uses a scatterlist to hold message data, and alongside that scatterlist sits an sg.copy bitmap. A set bit means the corresponding scatterlist entry might point to memory that doesn’t belong to the socket message alone — for example, pages that came from a splice() call and are still backed by the original file’s page cache. The sg.copy bit tells the kernel: “don’t hand a writable pointer to this entry.”
In a series of transform operations — moving, splitting, copying, compacting, shifting entries in the scatterlist — the sg.copy bit wasn’t reliably carried along. The kernel’s own advisory, drawn from the patch authored by Yiming Qian and reported with Keenan Dong, describes exactly how this happens. When an externally backed entry ends up in a new slot with its sg.copy bit cleared, a later SK_MSG BPF verdict can expose that entry as writable ctx->data. The BPF program can then modify the underlying page cache, effectively corrupting the file without ever opening it.
The vulnerable paths are inside BPF pull, push, and pop helpers; sk_msg_shift_left() and sk_msg_shift_right(); sk_msg_xfer(); and tls_split_open_record(). That last one is notable because it involves a partially created final entry during TLS open-record splitting — a scenario that could play out in encrypted network traffic handling.
“This is not a classic bounds-check bug where an isolated guard was missing,” the kernel’s changelog notes. “It is a state-propagation defect: an ownership tag became separated from the object it was supposed to describe.” The fix synchronizes sg.copy with sg.data[] every time entries change, and clears the bit when an entry is replaced with a freshly allocated private page or freed.
Who’s Affected — and Who Isn’t
Every Linux kernel from version 4.20 onward carries the dangerous code. The regression was introduced by commit d3b18ad31f93, which added TLS support to sk_msg handling. The following fixed baselines are referenced by NVD:
- Linux 6.1.177 and later in the 6.1 stable series
- Linux 6.6.144 and later in the 6.6 stable series
- Linux 6.12.95 and later in the 6.12 stable series
- Linux 6.18.38 and later in the 6.18 stable series
- Linux 7.1.3 and later in the 7.1 stable series
These version numbers are a starting point, not a guarantee. Enterprise distributions often backport security fixes while retaining an older version string. A server reporting 5.10.200 might already be patched if it’s from a distro that backported the fix. Conversely, a custom-compiled kernel on a higher version may lag if not rebuilt from the updated stable tree.
The bug lives in four source files: include/linux/skmsg.h, net/core/filter.c, net/core/skmsg.c, and net/tls/tls_sw.c. Exposure depends on whether a system actually loads BPF programs that exercise the SK_MSG path. A generic workstation with no BPF networking policy is at far lower risk than a multi-tenant Kubernetes node running service meshes, transparent proxies, or observability agents that attach BPF programs to sockets.
For Windows users, the biggest practical risk sits inside WSL 2. Microsoft documents that WSL 2 runs a real Linux kernel inside a lightweight utility VM. The WSL2 kernel is maintained by Microsoft in a separate repository, and it receives regular updates through the wsl --update mechanism. A vulnerable WSL2 kernel contains the exact same sk_msg code — and therefore the same hole.
WSL 1 is not affected. According to Microsoft’s architecture documentation, WSL 1 is a Windows-side implementation of Linux-compatible interfaces and does not contain an actual Linux kernel. The vulnerable code path simply doesn’t exist there.
The Fix: What You Need to Update
For WSL 2 users, the remedy is straightforward:
- Open a PowerShell or Command Prompt window and run:
wsl --update - After the update completes, shut down the WSL 2 managed VM:
wsl --shutdown - Start your distribution again and verify the running kernel version:
wsl uname -r
Don’t rely on the distribution’s package manager (apt, dnf, zypper) to handle the WSL2 kernel. In the standard WSL 2 setup, Microsoft ships and updates the shared kernel; the distribution’s user-space packages live on top of it. If you’re using a custom kernel setup — something achievable through wslconfig — you must check that kernel against the patch list above.
For Linux servers, workstations, and container hosts outside WSL, apply the latest kernel updates from your distribution’s standard channel. Record the advisory number, post-update kernel version, and the reboot or workload restart that puts the new kernel into service. A patched package sitting next to an old running kernel is still a vulnerable system.
If you run custom BPF code that touches SK_MSG, audit your programs. This isn’t just a perimeter-networking patch; any boundary that assumed BPF couldn’t write to file-backed pages is now understood to have been broken for years.
What to Do Right Now
Home and developer users with WSL 2: Update today. The command wsl --update checks for the latest WSL release, which by now should include the patched kernel. If wsl --update reports no new version, check wsl --status to see your current kernel version. Compare it against the fixed baselines above. If in doubt, head to the Microsoft WSL documentation or GitHub releases page for the most recent kernel package.
IT administrators: Inventory every Linux instance — whether bare metal, VM, or container host — that runs a kernel between 4.20 and an unpatched version. Prioritize systems that use eBPF networking features: service meshes, socket redirection, custom load balancers, or transparent TLS inspection. Check your configuration management tools to ensure the kernel update propagates correctly.
Developers maintaining BPF programs: Review any SK_MSG verdict programs. Assume that file-backed pages could have been writable before the patch. If your application relied on the integrity of file cache data, audit logs for unusual writes that might overlap with BPF socket activity.
Testing: Once updated, if you want to probe the patch yourself, the kernel.org commit references provide exact git hashes. You can confirm the fix is present by checking for the sg.copy synchronization logic in the sk_msg transform functions, or by running a test that splices a file into a socket message and attempts a writable BPF verdict. But for most users, simply verifying the kernel version string against a known-good baseline is sufficient.
NVD has not yet assigned a CVSS score or CWE classification. Don’t let that lull you. The exploitability depends on local BPF policy and loaded programs, not on network exposure alone. A sophisticated attacker with existing user access could chain this with other techniques to elevate privileges or corrupt critical files.
Looking Ahead
The Linux stable trees have the fix. Distributions are already integrating it into their kernel updates. If you manage a WSL 2 installation, keeping wsl --update as part of your regular maintenance is the simplest defense — not just for this CVE, but for any future kernel vulnerabilities that surface in the shared WSL2 kernel.
Microsoft’s MSRC advisory at the URL in the reference links will likely be updated if any Windows-specific vectors emerge. For now, the guidance is clear: patch your Linux kernels, patch your WSL2 kernel, and don’t mistake the absence of a CVSS score for safety. The bug’s been sitting there since Linux 4.20; the fix is finally here. Apply it.