CVE-2026-68284

Received Received - Intake

Use-After-Free in Linux Kernel BPF sockmap

Publication date: 2026-08-10

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_tx names the local temporary message by comparing it with the current value of psock->cork. This comparison is unsafe when two threads send on the same socket: Thread A Thread B msg_tx = psock->cork sk_msg_alloc() fails sk_stream_wait_memory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msg_tx != psock->cork sk_msg_free(msg_tx) The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported: BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: sk_msg_free+0x49/0x50 tcp_bpf_sendmsg+0x14f5/0x1cc0 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 89: __kasan_kmalloc+0x8f/0xa0 tcp_bpf_sendmsg+0x16b3/0x1cc0 Freed by task 91: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 tcp_bpf_sendmsg+0xec3/0x1cc0 msg_tx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-19

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68284

EUVD

EUVD-2026-55385

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) sockmap functionality. It occurs in the tcp_bpf_sendmsg() function when handling TCP send operations. The issue arises when two threads send data on the same socket simultaneously, causing a stale pointer to be incorrectly freed, leading to a kernel memory corruption bug.

Detection Guidance

This vulnerability is specific to the Linux kernel's BPF and sockmap functionality. Detection primarily involves checking kernel logs for KASAN reports or crashes related to tcp_bpf_sendmsg. Monitor system logs for errors like 'BUG: KASAN: slab-use-after-free in sk_msg_free' or kernel oops messages.

Impact Analysis

This vulnerability could allow an attacker to crash the system or potentially execute arbitrary code with kernel privileges. It may lead to denial-of-service conditions, system instability, or unauthorized access to sensitive data depending on the attacker's capabilities and system configuration.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's BPF sockmap implementation, specifically in tcp_bpf_sendmsg(). It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy controls rather than kernel memory management issues.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If patches are unavailable, disable BPF and sockmap features by removing or blacklisting the BPF-related kernel modules. Restrict untrusted users from loading BPF programs.

Hi! I’m here to help you understand CVE-2026-68284. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70