CVE-2026-98384 in Linux
Summary
by MITRE • 10/09/2026
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()
sk_protocol lives in struct sock, not in struct sock_common. A timewait or request sock handed to bpf_sock_destroy() by the tcp iterator is neither, so reading sk->sk_protocol runs past the object:
================================================================== BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0 Read of size 2 at addr ffff8881047d11b4 by task test_progs/428
Tainted: [W]=WARN
Call Trace: <TASK> dump_stack_lvl+0x91/0xf0 print_report+0xd1/0x630 kasan_report+0xf3/0x130 __asan_report_load2_noabort+0x14/0x30 bpf_sock_destroy+0xc7/0xe0 bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait+0x9f/0xb7 bpf_iter_run_prog+0x538/0xde0 bpf_iter_tcp_seq_show+0x26b/0x4b0 bpf_seq_read+0x424/0x1210 vfs_read+0x197/0xe40 ksys_read+0x119/0x240 __x64_sys_read+0x72/0xc0 x64_sys_call+0x647/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Only check sk_protocol on full socks. tcp_abort() already knows how to deal with TIME_WAIT and NEW_SYN_RECV socks. Also fix the comment, it never matched the code.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The Linux kernel contains a critical memory safety vulnerability within the BPF socket destruction subsystem that results in an out-of-bounds read operation. This flaw is located specifically in the bpf_sock_destroy function, where the implementation incorrectly attempts to access the sk_protocol field from a sock structure pointer that does not actually point to a full struct sock instance. The root cause of this issue lies in a fundamental misunderstanding of kernel data structures during iteration over TCP sockets. When the BPF iterator processes socket states such as TIME_WAIT or request sockets, it passes these objects to bpf_sock_destroy. However, these specific socket types are represented by different internal structures, namely struct sock_common for time-wait sockets and other variants for request sockets, rather than the full struct sock structure that contains the sk_protocol member. Consequently, when the code dereferences the pointer as if it were a complete struct sock, the memory access extends beyond the bounds of the actual allocated object into adjacent kernel memory regions.
This vulnerability is classified under CWE-125, which denotes an out-of-bounds read condition. From a security operations perspective, this flaw aligns with ATT&CK technique T1078, specifically relating to valid accounts and system processes being exploited for unauthorized access or information gathering through memory corruption. The immediate operational impact of this bug is the potential for kernel panic or system instability due to invalid memory accesses detected by Kernel Address Sanitizer (KASAN). In production environments where such conditions are triggered, it can lead to denial of service as the kernel may crash or enter a tainted state requiring a reboot. Furthermore, depending on the specific memory layout and contents adjacent to the socket structure, an attacker with local access could potentially leverage this out-of-bounds read to leak sensitive kernel information, thereby facilitating further privilege escalation attacks against the host system.
The resolution involves modifying the bpf_sock_destroy function to strictly validate that the passed pointer corresponds to a full struct sock before attempting to access sk_protocol. The fix ensures that protocol-specific checks are only performed on sockets where this data is safely accessible within the object boundaries. Additionally, the update corrects associated documentation comments that previously misaligned with the actual code logic, reducing future maintenance errors and improving clarity for developers reviewing the BPF iterator implementation. This patch leverages existing kernel mechanisms such as tcp_abort(), which already possesses the necessary logic to handle TIME_WAIT and NEW_SYN_RECV socket states appropriately without requiring direct access to sk_protocol in those contexts.
To mitigate this vulnerability, system administrators should apply the latest available Linux kernel updates that include this specific fix for bpf_sock_destroy. Organizations relying on eBPF programs for network monitoring or security enforcement must ensure their host systems are patched against this out-of-bounds read condition. Regular auditing of BPF program loads and strict validation of socket types passed to BPF helpers can further reduce the attack surface. Maintaining up-to-date kernel versions is essential as these low-level memory safety issues often serve as initial footholds for more complex exploitation chains targeting containerized environments or cloud infrastructure where eBPF capabilities are heavily utilized for observability and security enforcement.