CVE-2026-74589

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF sockmap feature. A use-after-free vulnerability exists in the skredir mechanism within the tcpbpfsendmsgredir function. This occurs when a socket reference is prematurely released while another thread still holds a raw pointer to i...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed issues where data was not being charged when msg-sg.size contained more data. In tcpbpfsendverdict: If msg-sg.size contains more data after tcpbpfsendmsgredir: c tcpbpfsendverdict tosend = msg-sg.size...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fixed a panic that occurred when calling skblinearize. The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 A kernel panic was then captured: '''...

SUSE CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

AZL-97212 CVE-2026-74589 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589

A use-after-free vulnerability exists in the Linux kernel's BPF sockmap feature, specifically in the sk_redir handling within tcp_bpf_sendmsg_redir(). The function tcp_bpf_send_verdict() copies the psock->sk_redir pointer while holding the source socket lock but fails to take a reference for t...

CVE-2026-74589 bpf, sockmap: Fix sk_redir use-after-free in send verdict

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589 bpf, sockmap: Fix sk_redir use-after-free in send verdict

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

EUVD-2026-64526

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

PT-2026-79594

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk redir use-after-free in send verdict sk psock msg verdict takes a socket reference for psock-sk redir. tcp bpf send verdict copies that pointer while holding the source socket lock, but does not take a...

Linux Distros Unpatched Vulnerability : CVE-2026-74589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer whi...

SUSE-SU-2026:23244-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

SUSE-SU-2026:23193-1 Security update for the Linux Kernel

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 RT kernel was updated to fix various security issues: The following security issues were fixed: - CVE-2025-68741: scsi: qla2xxx: Fix improper freeing of purex item bsc1255703. - CVE-2025-68818: scsi: Revert "scsi: qla2xxx: Perform lockless command...

CVE-2026-68386

A flaw was found in the Linux kernel. A local attacker with BPF program capabilities could exploit a vulnerability in the BPF sockmap feature. This occurs when a BPF program increments the reference count of an unbound UDP socket, and the socket is subsequently bound. This sequence of events caus...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

UBUNTU-CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

EUVD-2026-55385

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...