CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

CVE-2026-74714 is a use-after-free in the Linux kernel's bpf_iter_tcp_established_batch() function. The root cause is a race condition: when a TCP request_sock is being published onto the ehash chain, its refcount is still zero until after the bucket lock is dropped. The BPF TCP iterator calls pl...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64401

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

PT-2026-79719

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf iter tcp established batch reqsk queue hash req publishes a TCP NEW SYN RECV request sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk refcnt to 3. Lockless readers...