CVE-2025-39913

CVE-2025-39913 - Linux Kernel eBPF SOCKMAP UAF Author: Byte Reaper My platform :https://www.bytrep.com/ Description This repository contains a technical proof-of-concept for CVE-2025-39913, a vulnerability in the Linux kernel's tcpbpfsendverdict function. When bpfmsgcorkbytes fails to allocate...

kernel: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter sockmap component when used with kernel TLS kTLS receive. A race condition exists where skpsockverdictdataready can improperly interact with the kTLS receive process. This can lead to a use-after-free vulnerability, potentially...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-151327)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151327 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 la...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-151326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151326 advisory. In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket referen...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AFUNIX GC. When a socket in SOCKMAP receives a skb containing an inflight fd, skpsockverdictdataready looks up the mapped socket and enqueues the skb ...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: tls: reject the combination of TLS and sockmap The integration of TLS and sockmap BPF psock hides many latent bugs. These bugs may be relevant to real users, though they are certainly exploitable. We couldn’t find anyone actively...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg tcpbpfsendmsg keeps msgtx across skstreamwaitmemory, which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary messag...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb, which increments...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when they become auto-bound. This means that skisrefcountedunbound = true, while skisrefcountedbound = false. Since sockmap accepts unbou...

CVE-2026-98925

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter sockmap subsystem. This flaw allows a local attacker to cause a Denial of Service DoS when redirecting network traffic back to the originating socket. The kernel improperly double-counts sequence numbers for received TCP Transmissi...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues: The following security issues were fixed: CVE-2025-68358: btrfs: fix racy bitfield write in btrfsclearspaceinfofull bsc1255531. CVE-2026-43091: xfrm: Wait for RCU readers during policy netns exit bsc1264267...

SUSE CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

Linux Distros Unpatched Vulnerability : CVE-2026-98925

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program...

DEBIAN-CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

AZL-110995 CVE-2026-98925 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

UBUNTU-CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98925

The Linux kernel contains a vulnerability in bpf, sockmap where a BPF stream_verdict program performing a self-redirect (with BPF_F_INGRESS ) causes double-counting of tcp_sk->copied_seq. When sk_psock_verdict_apply() calls tcp_eat_skb(), it advances the sequence counter; however, the same pac...