CVE-2026-64575
Received Received - Intake

Double Free in Linux Kernel BPF

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers. bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr 0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64575
EUVD
EUVD-2026-53269

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a bug in the BPF (Berkeley Packet Filter) TCP iterator causes a double release of socket references. When batch reallocation fails, the function returns an error before properly cleaning up, leaving invalid data in the batch. Later operations then incorrectly treat socket cookies as valid socket pointers, leading to a null-pointer dereference and kernel panic.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF (Berkeley Packet Filter) implementation and may not have direct network detection commands. Monitor kernel logs for KASAN errors or null-ptr-deref messages related to __sock_gen_cookie or bpf_iter_tcp_put_batch. Check for kernel panics or crashes during BPF operations.

Impact Analysis

An attacker could exploit this to crash the system by triggering a kernel panic, causing a denial of service. The vulnerability requires local access to exploit, so remote exploitation is unlikely. Systems using BPF features with TCP iteration may be affected.

Compliance Impact

This vulnerability is a kernel-level issue in the Linux TCP stack that could lead to a null-pointer dereference and kernel panic. It does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a system stability and availability issue rather than a data privacy or security control failure.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider disabling BPF-related features or restricting access to BPF tools until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64575. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart