UBUNTU-CVE-2026-80738

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skstate before skprotocol in bpftcpsyncookie bpftcpgensyncookie and bpftcpchecksyncookie accept a socket pointer 'sk' with argument type ARGPTRTOBTFIDSOCKCOMMON. However, they access sk-skprotocol without validating...

PT-2026-90893

In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk state before sk protocol in bpf tcp syncookie bpf tcp gen syncookie and bpf tcp check syncookie accept a socket pointer 'sk' with argument type ARG PTR TO BTF ID SOCK COMMON. However, they access sk-sk protocol...

SUSE CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

AZL-97064 CVE-2026-74714 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

A use-after-free vulnerability in the Linux kernel BPF TCP iterator, specifically in bpf_iter_tcp_established_batch(). The root cause is a race condition: sock_hold() increments the reference count of a request_sock whose rsk_refcnt is still zero at publish time, and the subsequent refcount_set(3...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64401

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

Linux Distros Unpatched Vulnerability : CVE-2026-74714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock,...

PT-2026-79719

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel within the bpf iter tcp established batch function. The problem occurs because the function uses sock hold while holding a bucket lock,...

SUSE CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

PT-2026-68076

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the BPF TCP implementation where a double socket release can occur during batch reallocation. The function bpf iter tcp batch releases the current batch using bpf iter...

Linux Distros Unpatched Vulnerability : CVE-2026-64575

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites...

PT-2023-36576

Уязвимость функции bpf basertt модуля samples/bpf/tcp basertt kern.c ядра операционной системы Linux связана с копированием буфера без проверки размера входных данных классическое переполнение буфера. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...