CVE-2025-39913

CVE-2025-39913 - Linux 内核 eBPF SOCKMAP UAF 作者：Byte Reaper 我的平台：https://www.bytrep.com/ 描述 该仓库包含 CVE-2025-39913 的技术性概念验证，这是 Linux 内核 tcpbpfsendverdict 函数中的一个漏洞。当 bpfmsgcorkbytes 未能分配 psock-cork 时，内核可能跳过释放 skmsg，从而导致内存管理不当。在特定的 eBPF skmsg 操作下，这可能导致内存泄漏或潜在的使用后释放（UAF）条件。 影响支持 SOCKMAP 的 Linux 内核版本 ≤...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fixed a panic that occurred when calling skblinearize. The panic can be reproduced by executing the command: ./bench sockmap -c 2 -p 1 -a --rx-verdict-ingress --rx-strp 100000 A kernel panic was then captured: '''...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: mptcp: Fixed the detection of protocol fallback using BPF. The sockmap feature allows for BPF syscall from user space, or based on BPF sockops, replacing the skprot of sockets during protocol stack processing with sockmap’s...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed a race condition between element replacement and close. The element replacement with a socket that is different from the one stored may race with the close operation, where the link of the socket is popped...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed issues where data was not being charged when msg-sg.size contained more data. In tcpbpfsendverdict: If msg-sg.size contains more data after tcpbpfsendmsgredir: c tcpbpfsendverdict tosend = msg-sg.size...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fixed the issue where the memory of skmsg was uncharged twice. If tcpbpfsendmsg is running during a cleanup operation, psock may be freed. c tcpbpfsendmsg tcpbpfsendverdict skmsgreturn tcpbpfsendmsgredir...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcpbpfprots when cloning a listener. A listening socket linked to a sockmap has its skprot overridden. It points to one of the struct proto variants in tcpbpfprots. This variant depends on the...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in skmsgrecvmsg When running BPF selftests ./testprogs -t sockmapbasic on a Loongarch platform, the following kernel panic occurs: ... Oops1: CPU: 22 PID: 2824 Comm: testprogs Tainted: G OE 6.10.0-rc2+...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject skmsg egress redirects to non-TCP sockets With a SOCKMAP/SOCKHASH map and an skmsg program user can steer messages sent from one TCP socket s1 to actually egress from another TCP socket s2: tcpbpfsendmsgs1 //...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed a race condition in sockmapfree. sockmapfree calls releasesocksk without owning a reference to the socket. This could lead to a use-after-free, as syzbot identified this issue 1. Jakub Sitnicki already...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed the memory leak in bpfskselectreuseport As pointed out in the original comment, a lookup in sockmap can return a TCP ESTABLISHED socket. Such a TCP socket may have had SOATTACHREUSEPORTEBPF set before it became...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed the warning related to sk-skforwardalloc in skstreamkillqueues. When running testsockmap in selftests, the following warning appears: WARNING: CPU: 2 PID: 197 at net/core/stream.c:205...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: fixed the ktls panic with sockmap 2172.936997 ------------ Cut here ------------ 2172.936999 Kernel BUG at lib/ioviter.c:629! ...... 2172.944996 PKRU: 55555554 2172.945155 Call Trace: 2172.945299 2172.945428 ? die+0x36/0x...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: vsock: Ignore signals/timesouts on connect if the socket is already established. During connect, acting on a signal/timesout by disconnecting an already established socket leads to several issues: 1. connect invokes...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: BPF, sockmap: Prevent lock inversion deadlock in mapdeleteelem operation. The syzkaller started using corpuses where a BPF tracing program deletes elements from a sockmap/sockhash map. Since BPF tracing programs can be invoked fr...

Linux Distros Unpatched Vulnerability : CVE-2026-80735

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500248 advisory. - inet: frags: strip GSO state from fragments before reassembly Xinyang Ge Orabug: 39974840 CVE-2026-80590 - KVM: x86: Cancel delayed I/O APIC E...

CVE-2026-80735

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...

UBUNTU-CVE-2026-80735

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...

EUVD-2026-70339

In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref skuserdata Some subsystems, like BPF SOCKMAP, set skuserdata without actually setting the encaptype. For this reason, we must make sure that the type is the one ovpn expects befor...