{"id":"CVE-2026-64575","revision":"b0cb22b3d176429fbea38476730eec32","records":[{"revision":"b0cb22b3d176429fbea38476730eec32","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64575","aliases":[],"title":"bpf: tcp: fix double sock release on batch realloc","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: fix double sock release on batch realloc\n\nbpf_iter_tcp_batch() releases the current batch via\nbpf_iter_tcp_put_batch(), which drops the socket refs and rewrites\neach slot with the socket cookie, then grows the batch. cur_sk/end_sk\nare kept for bpf_iter_tcp_resume(), but on realloc failure the function\nreturns ERR_PTR() before resume runs, leaving cur_sk < end_sk over\nslots that now hold cookies rather than sock pointers.\nbpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and\ndereferences a cookie as a struct sock.\n\nEmpty the batch on the failure path so stop() does not release it\nagain. The sockets were already freed by the first\nbpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans\nthe bucket from the start instead of skipping it. The sibling\nGFP_NOWAIT failure path still holds real socket references and is left\nfor stop() to release.\n\n  BUG: KASAN: null-ptr-deref in __sock_gen_cookie\n  Read of size 8 at addr 0000000000000059 by task exploit\n   ...\n   __sock_gen_cookie (net/core/sock_diag.c:28)\n   bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918)\n   bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270)\n   bpf_seq_read (kernel/bpf/bpf_iter.c:205)\n   vfs_read (fs/read_write.c:572)\n   ksys_read (fs/read_write.c:716)\n   do_syscall_64\n   entry_SYSCALL_64_after_hwframe\n  Kernel panic - not syncing: Fatal exception","state":0,"publishedAt":"2026-08-05T08:09:31.923+00:00","modifiedAt":"2026-10-19T20:48:42.635+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/tcp_ipv4.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"9794ac757a650dd594391192183c9caf939f8223\",\n                            \"lessThan\": \"c842882e4c5d2818b858d6baf3fd10958c93f729\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"1d7a82c1df5fc397eaca9c6b8c8f61aae9866ad4\",\n                            \"lessThan\": \"7a6a6d2a127866935f87b55b557bc89693065462\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"36f955807ee4ede07e9410772f792e4cb4ec807b\",\n                            \"lessThan\": \"f0c1810320b0dac228103fad7311e89532134d83\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdec67a489d4fdae3e83e04fca0419136a83c4c2\",\n                            \"lessThan\": \"9f27c4f0ae35b5390ce4f7a54d3501144e41a54d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdec67a489d4fdae3e83e04fca0419136a83c4c2\",\n                            \"lessThan\": \"8a726e9585ffe7bfbfad2b5279277a00973970f3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdec67a489d4fdae3e83e04fca0419136a83c4c2\",\n                            \"lessThan\": \"980a813452754f8001704744e92f7aa697c53dd3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/tcp_ipv4.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.17\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.17\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/c842882e4c5d2818b858d6baf3fd10958c93f729","https://git.kernel.org/stable/c/7a6a6d2a127866935f87b55b557bc89693065462","https://git.kernel.org/stable/c/f0c1810320b0dac228103fad7311e89532134d83","https://git.kernel.org/stable/c/9f27c4f0ae35b5390ce4f7a54d3501144e41a54d","https://git.kernel.org/stable/c/8a726e9585ffe7bfbfad2b5279277a00973970f3","https://git.kernel.org/stable/c/980a813452754f8001704744e92f7aa697c53dd3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64575","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64575","identifiers":["CVE-2026-64575"]},"retained":false,"historicalAffected":[]}],"coverage":[]}