CVE-2026-68399

The CVE is a Linux kernel issue in BPF sock clone logic. During sk_clone(), the socket’s BPF storage is shallow-copied to the new socket via sock_copy(). If the clone bails out early (e.g., sk_filter_charge() failure) before bpf_sk_storage_clone() runs, newsk->sk_bpf_storage may still referenc...