CVE-2026-68399 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in sock clone early bailouts
Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.
If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket.
Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability resides within the Linux kernel's Berkeley Packet Filter implementation where a use-after-free condition occurs during socket cloning operations. The flaw manifests in the sk_clone() function which handles the creation of cloned socket structures, particularly when early bailouts occur before proper BPF storage initialization. The issue stems from improper handling of the ->sk_bpf_storage field that maintains references to BPF local storage associated with sockets.
The technical implementation involves a shallow copy operation performed by sock_copy() that transfers the ->sk_bpf_storage pointer from the parent socket to the newly cloned socket structure. When sk_clone() encounters early termination conditions such as failures in sk_filter_charge(), it exits without properly initializing or clearing the BPF storage reference in the new socket. This leaves newsk->sk_bpf_storage pointing to memory locations that belong to the parent socket's BPF local storage, creating a dangerous dangling pointer situation.
During subsequent socket cleanup operations when sk_free() is called on the cloned socket, the kernel's destruction path executes __sk_destruct() which in turn calls bpf_sk_storage_free(). This function attempts to free the BPF storage associated with what it believes is the cloned socket but actually operates on the parent socket's storage, resulting in a use-after-free condition. The parent socket's memory gets freed while still being referenced by other parts of the system, leading to potential memory corruption and arbitrary code execution.
This vulnerability directly maps to CWE-416 which describes use-after-free conditions, and aligns with ATT&CK technique T1059.007 for command and scripting interpreter with potential exploitation through kernel memory corruption. The flaw represents a classic race condition in resource management where improper cleanup sequences create dangling references that persist beyond their intended lifecycle.
The fix implements a defensive programming approach by explicitly setting newsk->sk_bpf_storage to NULL immediately after the sock_copy() operation within sk_clone(). This ensures that even if early bailouts occur, no invalid references remain pointing to the parent socket's BPF storage. The solution also removes redundant initialization logic from bpf_sk_storage_clone() since the primary responsibility for managing the reference now lies with the sk_clone() function itself. This remediation follows established security practices for preventing use-after-free vulnerabilities in kernel space memory management.
The operational impact of this vulnerability extends beyond simple memory corruption, potentially allowing privilege escalation attacks where malicious users could exploit the UAF condition to execute arbitrary code with kernel privileges. The fix maintains system stability by ensuring proper resource cleanup and preventing dangling pointer references that could be leveraged by attackers to compromise system integrity. This type of vulnerability represents a critical security concern in kernel space where memory safety violations can have catastrophic consequences for system security posture and availability.