CVE-2026-74589

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF sockmap feature. A use-after-free vulnerability exists in the skredir mechanism within the tcpbpfsendmsgredir function. This occurs when a socket reference is prematurely released while another thread still holds a raw pointer to i...

SUSE CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589

A use-after-free vulnerability exists in the Linux kernel's BPF sockmap feature, specifically in the sk_redir handling within tcp_bpf_sendmsg_redir(). The function tcp_bpf_send_verdict() copies the psock->sk_redir pointer while holding the source socket lock but fails to take a reference for t...

CVE-2026-74589 bpf, sockmap: Fix sk_redir use-after-free in send verdict

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

EUVD-2026-64526

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589 bpf, sockmap: Fix sk_redir use-after-free in send verdict

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

PT-2026-79594

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix sk redir use-after-free in send verdict sk psock msg verdict takes a socket reference for psock-sk redir. tcp bpf send verdict copies that pointer while holding the source socket lock, but does not take a...

Linux Distros Unpatched Vulnerability : CVE-2026-74589

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer whi...

CVE-2026-68386

A flaw was found in the Linux kernel. A local attacker with BPF program capabilities could exploit a vulnerability in the BPF sockmap feature. This occurs when a BPF program increments the reference count of an unbound UDP socket, and the socket is subsequently bound. This sequence of events caus...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

UBUNTU-CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

CVE-2026-68284

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-68386

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

EUVD-2026-55385

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

UBUNTU-CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64548

The CVE-2026-64548 vulnerability affects the Linux kernel’s BPF/sockmap path. A truncation can occur in bpf_msg_push_data when the scatterlist ring is full or nearly full: len (from BPF ARG_ANYTHING) and copy size are both u32, and the code path uses copy + len to compute a page allocation. An at...

CVE-2026-64548 bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64025

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter sockmap component when used with kernel TLS kTLS receive. A race condition exists where skpsockverdictdataready can improperly interact with the kTLS receive process. This can lead to a use-after-free vulnerability, potentially...