CVE-2025-39913

CVE-2025-39913 - Linux 内核 eBPF SOCKMAP UAF 作者：Byte Reaper 我的平台：https://www.bytrep.com/ 描述 该仓库包含 CVE-2025-39913 的技术性概念验证，这是 Linux 内核 tcpbpfsendverdict 函数中的一个漏洞。当 bpfmsgcorkbytes 未能分配 psock-cork 时，内核可能跳过释放 skmsg，从而导致内存管理不当。在特定的 eBPF skmsg 操作下，这可能导致内存泄漏或潜在的使用后释放（UAF）条件。 影响支持 SOCKMAP 的 Linux 内核版本 ≤...

The vulnerability of the `tcp_bpf_send_verdict()` function in the `net/ipv4/tcp_bpf.c` module, which is part of the IPv4 protocol implementation in Linux kernel, allows a attacker to cause a service failure.

The vulnerability of the tcpbpfsendverdict function in the net/ipv4/tcpbpf.c module of the Linux operating system’s IPv4 protocol implementation leads to uncontrolled resource consumption. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

CVE-2026-74589: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skredir use-after-free in send verdict skpsockmsgverdict takes a socket reference for psock-skredir. tcpbpfsendverdict copies that pointer while holding the source socket lock, but does not take a reference for...

EUVD-2022-55022

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

CVE-2022-49204

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

CVE-2022-49204

Summary: CVE-2022-49204 is a Linux kernel vulnerability in the bpf/sockmap path related to uncharged data handling when a tcp_bpf_sendmsg_redir sequence occurs. The root cause is that msg->sg.size can be charged twice across the __SK_REDIRECT path, leading to uncharged memory being left in sk_...

CVE-2022-49204 bpf, sockmap: Fix more uncharged while msg has more_data

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

CVE-2022-49204: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...