Skip to content
Heist/ feed
High

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_tx names the local temporary message by comparing it with the current value of psock->cork. This comparison is unsafe when two threads send on the same socket: Thread A Thread B msg_tx = psock->cork sk_msg_alloc() fails sk_stream_wait_memory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msg_tx != psock->cork sk_msg_free(msg_tx) The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported: BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: sk_msg_free+0x49/0x50 tcp_bpf_sendmsg+0x14f5/0x1cc0 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 89: __kasan_kmalloc+0x8f/0xa0 tcp_bpf_sendmsg+0x16b3/0x1cc0 Freed by task 91: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 tcp_bpf_sendmsg+0xec3/0x1cc0 msg_tx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one.

Announced Source revision 1
Original source ↗

CVE-2026-68284

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-68284

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "0688e6fe599d2d39147ae9ece97944c6e1815ebf",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "b2bcbeabfd843d47468fa095b1bd08ddb90cf616",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "54be47e7cbb936429c3bbdfc526ea943954aaf80",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "ee762f684eefa59de34d9ed93cab08336e834f47",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "cde4d6bcd9b73073c66498f6723c7b364c4dbc18",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "786d690257ec7a0c839f8710456e444ce3f1348b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "752b1159ed5d0c48fe169a3721b96660a9822aa1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
        "lessThan": "2d66a033864e27ab8d5e44cb36f31d9d2413bee4",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/ipv4/tcp_bpf.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.20"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.20",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.265",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.216",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.183",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.148",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.101",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.42",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv4/tcp_bpf.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-68284

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#41169 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement