{"id":"CVE-2026-74268","revision":"4f820d075dc64c8ab4b2f2b85efb4b5a","records":[{"revision":"4f820d075dc64c8ab4b2f2b85efb4b5a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74268","aliases":[],"title":"tcp: clear sock_ops cb flags before force-closing a child socket","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: clear sock_ops cb flags before force-closing a child socket\n\nA child socket inherits the listener's bpf_sock_ops_cb_flags via\nsk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() /\ntcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where\ninet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs\nwithout it.\n\nIf BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state()\ncalls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():\n\n WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550\n RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799\n Call Trace:\n \n tcp_done+0xba/0x250 net/ipv4/tcp.c:5095\n tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787\n tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926\n tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164\n \n\nThe child is freed before it is ever established, so it should run no\nsock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(),\nthe common point for the IPv4, IPv6 and chtls forced-close paths and for the\nMPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done()\non a child that was never established too.","state":0,"publishedAt":"2026-08-15T05:57:42.92+00:00","modifiedAt":"2026-10-16T18:55:28.993+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"include/net/tcp.h\",\n \"net/ipv4/inet_connection_sock.c\"\n ],\n \"versions\": [\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"5d5389b2c37ca00da61d1407618ebe15abae0c8b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"9f30ba9aa0270a18fdd1e6cd426c480c35f7de9d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"71e9c53220abd7f5a45aa4d5e5b420d3479f3a4f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"9fffa6465851a1910a6e9cb7272787dd615b26b1\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"fe23d56e9266d58ba5c380f1970118eedeee0b68\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"ce311bd2e36596f0aa2c92ca86fb3e019ac57eae\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"8874dafc9099bc49c2e5ebba030f85d276421f92\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"d44874910a26f3a8f81edf873a2473363f07f660\",\n \"lessThan\": \"990348e5bb457697c2f1f7f7b65154a3334d9d2b\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"include/net/tcp.h\",\n \"net/ipv4/inet_connection_sock.c\"\n ],\n \"versions\": [\n {\n \"version\": \"4.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"4.16\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.270\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.221\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.188\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.157\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.110\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.40\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.5\",\n \"lessThanOrEqual\": \"7.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/5d5389b2c37ca00da61d1407618ebe15abae0c8b","https://git.kernel.org/stable/c/9f30ba9aa0270a18fdd1e6cd426c480c35f7de9d","https://git.kernel.org/stable/c/71e9c53220abd7f5a45aa4d5e5b420d3479f3a4f","https://git.kernel.org/stable/c/9fffa6465851a1910a6e9cb7272787dd615b26b1","https://git.kernel.org/stable/c/fe23d56e9266d58ba5c380f1970118eedeee0b68","https://git.kernel.org/stable/c/ce311bd2e36596f0aa2c92ca86fb3e019ac57eae","https://git.kernel.org/stable/c/8874dafc9099bc49c2e5ebba030f85d276421f92","https://git.kernel.org/stable/c/990348e5bb457697c2f1f7f7b65154a3334d9d2b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74268","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74268","identifiers":["CVE-2026-74268"]},"retained":false,"historicalAffected":[]}],"coverage":[]}