CVE-2026-74589 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix sk_redir use-after-free in send verdict
sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcp_bpf_sendmsg_redir().
When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket can consume the remaining bytes and release the cached reference while the first thread still holds only the raw local pointer:
CPU 0 CPU 1 sk_redir = psock->sk_redir apply_bytes remains nonzero release_sock(sk) lock_sock(sk) apply_bytes reaches zero psock->sk_redir = NULL release_sock(sk) tcp_bpf_sendmsg_redir(sk_redir) sock_put(sk_redir) tcp_bpf_sendmsg_redir(sk_redir)
The final sock_put() can free sk_redir before CPU 0 dereferences it.
KASAN reported:
BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020 Read of size 8 at addr ffff888108537090 by task poc/87 Call Trace: tcp_bpf_sendmsg_redir+0xf39/0x1020 tcp_bpf_sendmsg+0x977/0x1a50 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 85: sk_prot_alloc+0x56/0x210 sk_clone+0x6f/0x14b0 inet_csk_clone_lock+0x24/0x740 tcp_create_openreq_child+0x25/0x2710 tcp_v4_syn_recv_sock+0x10a/0xe00 Freed by task 0: __kasan_slab_free+0x43/0x70 slab_free_after_rcu_debug+0xa6/0x1e0 rcu_core+0x50a/0x1850 Last potentially related work creation: __sk_destruct+0x3da/0x540 sk_psock_destroy+0x81e/0xab0 process_one_work+0x63a/0x1070
Take a temporary socket reference while the source socket lock still protects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir() returns. This keeps each unlocked use independent of cached-verdict ownership.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel contains a critical race condition within the BPF sockmap implementation that results in a use-after-free vulnerability during socket redirection operations. Specifically, the function sk_psock_msg_verdict interacts with tcp_bpf_send_verdict to manage references for redirected sockets via psock->sk_redir. The core technical flaw lies in the handling of reference counting and lock scopes within tcp_bpf_send_verdict. While this function copies the pointer from psock->sk_redir while holding the source socket lock, it fails to increment the reference count on that local copy before releasing the lock. This omission creates a window where the cached verdict remains active but unprotected by synchronization primitives, allowing concurrent operations to modify or free the underlying socket structure prematurely.
The operational impact of this vulnerability manifests when multiple threads perform sendmsg() calls on the same source socket simultaneously. In a typical race scenario, one thread may hold a raw pointer to sk_redir after dropping the lock, while another thread completes its transmission and releases the cached reference by setting psock->sk_redir to NULL and decrementing the socket's usage count via sock_put(). If the first thread subsequently attempts to use its stale local copy of sk_redir through tcp_bpf_sendmsg_redir(), it accesses memory that has already been freed. This leads to a slab-use-after-free condition, which can be detected by Kernel Address Sanitizer (KASAN) as an invalid read operation on a reclaimed object address.
From a security perspective, this vulnerability is classified under CWE-416: Use After Free. The exploitation of this flaw could potentially allow an attacker with local access to execute arbitrary code within the kernel context or cause a denial of service by triggering a kernel panic due to memory corruption. The attack vector aligns with ATT&CK technique T1059, specifically command and script interpretation via system utilities if the vulnerability is leveraged for privilege escalation, although the primary immediate risk is stability degradation through kernel crashes.
The resolution involves modifying tcp_bpf_send_verdict to take a temporary socket reference while the source socket lock is still held. This ensures that the local copy of sk_redir remains valid even after the lock is released and before tcp_bpf_sendmsg_redir completes its operation. The additional reference count must be dropped only after the redirection function returns, thereby decoupling each unlocked use from the ownership state of the cached verdict. To mitigate this issue in affected systems, administrators should apply the latest kernel updates provided by their distribution vendors that include this specific patch for BPF sockmap reference counting logic.