CVE-2026-68379

Received Received - Intake

TCP TIME_WAIT Socket Reference Leak in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIME_WAIT socket reference leak on PSP policy failure Release the TIME_WAIT socket reference and jump to discard_it upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcp_tw_bucket structures.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68379

EUVD

EUVD-2026-55565

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in TCP TIME_WAIT sockets. When a PSP policy fails during packet processing in IPv4 or IPv6, the kernel fails to release a reference to a TIME_WAIT socket, causing tcp_tw_bucket structures to leak memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's TCP implementation and may not have direct detection commands. Monitor for unusual memory usage in tcp_tw_bucket structures or TIME_WAIT socket leaks using kernel monitoring tools like ss, netstat, or slabtop.

Impact Analysis

The memory leak could gradually consume system memory over time, potentially leading to degraded performance or system instability if many TIME_WAIT sockets are leaked. This primarily affects servers handling many TCP connections.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a memory leak in the Linux kernel's TCP implementation rather than data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, consider applying kernel patches or mitigating by adjusting TCP settings to reduce TIME_WAIT socket accumulation.

Hi! I’m here to help you understand CVE-2026-68379. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70