CVE-2026-64025
Received Received - Intake

Race Condition in Linux Kernel BPF SK_MSG Verification with KTLS

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64025
EUVD
EUVD-2026-45598

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) and skmsg (socket message) subsystems. It occurs when a socket is placed in a sockmap before TLS RX is configured, leading to a race condition where a freed skb (socket buffer) is accessed during TLS decryption.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF and skmsg components with KTLS interactions. Detection requires checking kernel version and BPF-related configurations. Use uname -a to verify kernel version and grep BPF-related modules in lsmod. Monitor kernel logs for sk_psock_verdict_data_ready warnings or TLS-related errors.

Impact Analysis

An attacker could exploit this to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. Systems using BPF sockmaps with TLS may be affected.

Compliance Impact

This vulnerability is a Linux kernel issue related to BPF and TLS socket handling. It does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level system bug affecting data processing integrity rather than privacy or security controls.

Mitigation Strategies

Apply the latest Linux kernel security patches addressing this issue. Disable BPF sockmap usage if not required. Update BPF-related tools and libraries. Monitor for unusual network activity or kernel crashes. Restrict untrusted users from loading BPF programs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64025. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart