{"id":"CVE-2026-68284","revision":"ce00b23718aa4191bcbc1e466d01acb3","records":[{"revision":"ce00b23718aa4191bcbc1e466d01acb3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68284","aliases":[],"title":"bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n\ntcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which\ndrops and reacquires the socket lock.  Its error path tries to decide\nwhether msg_tx names the local temporary message by comparing it with\nthe current value of psock->cork.\n\nThis comparison is unsafe when two threads send on the same socket:\n\n  Thread A                         Thread B\n  msg_tx = psock->cork\n  sk_msg_alloc() fails\n  sk_stream_wait_memory()\n    releases the socket lock      acquires the socket lock\n                                  completes the cork\n                                  psock->cork = NULL\n                                  frees the cork\n    reacquires the socket lock\n  msg_tx != psock->cork\n  sk_msg_free(msg_tx)\n\nThe stale cork is therefore mistaken for the local temporary message\nand freed again.  KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50\n  Read of size 4 at addr ffff88810c908800 by task poc/90\n  Call Trace:\n   sk_msg_free+0x49/0x50\n   tcp_bpf_sendmsg+0x14f5/0x1cc0\n   __sys_sendto+0x32c/0x3a0\n   __x64_sys_sendto+0xdb/0x1b0\n  Allocated by task 89:\n   __kasan_kmalloc+0x8f/0xa0\n   tcp_bpf_sendmsg+0x16b3/0x1cc0\n  Freed by task 91:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   tcp_bpf_sendmsg+0xec3/0x1cc0\n\nmsg_tx can only name the stack-local tmp or the shared cork. Check for\ntmp directly so a changed psock->cork cannot turn a shared message into\nan apparent local one.","state":0,"publishedAt":"2026-08-10T12:02:16.572+00:00","modifiedAt":"2026-10-19T20:58:59.373+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/tcp_bpf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"0688e6fe599d2d39147ae9ece97944c6e1815ebf\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"b2bcbeabfd843d47468fa095b1bd08ddb90cf616\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"54be47e7cbb936429c3bbdfc526ea943954aaf80\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"ee762f684eefa59de34d9ed93cab08336e834f47\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"cde4d6bcd9b73073c66498f6723c7b364c4dbc18\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"786d690257ec7a0c839f8710456e444ce3f1348b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"752b1159ed5d0c48fe169a3721b96660a9822aa1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"604326b41a6fb9b4a78b6179335decee0365cd8c\",\n                            \"lessThan\": \"2d66a033864e27ab8d5e44cb36f31d9d2413bee4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv4/tcp_bpf.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.20\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.20\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf","https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616","https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80","https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47","https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18","https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b","https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1","https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68284","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68284","identifiers":["CVE-2026-68284"]},"retained":false,"historicalAffected":[]}],"coverage":[]}