{"id":"CVE-2026-68284","state":"PUBLISHED","title":"bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n\ntcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which\ndrops and reacquires the socket lock.  Its error path tries to decide\nwhether msg_tx names the local temporary message by comparing it with\nthe current value of psock->cork.\n\nThis comparison is unsafe when two threads send on the same socket:\n\n  Thread A                         Thread B\n  msg_tx = psock->cork\n  sk_msg_alloc() fails\n  sk_stream_wait_memory()\n    releases the socket lock      acquires the socket lock\n                                  completes the cork\n                                  psock->cork = NULL\n                                  frees the cork\n    reacquires the socket lock\n  msg_tx != psock->cork\n  sk_msg_free(msg_tx)\n\nThe stale cork is therefore mistaken for the local temporary message\nand freed again.  KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50\n  Read of size 4 at addr ffff88810c908800 by task poc/90\n  Call Trace:\n   sk_msg_free+0x49/0x50\n   tcp_bpf_sendmsg+0x14f5/0x1cc0\n   __sys_sendto+0x32c/0x3a0\n   __x64_sys_sendto+0xdb/0x1b0\n  Allocated by task 89:\n   __kasan_kmalloc+0x8f/0xa0\n   tcp_bpf_sendmsg+0x16b3/0x1cc0\n  Freed by task 91:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   tcp_bpf_sendmsg+0xec3/0x1cc0\n\nmsg_tx can only name the stack-local tmp or the shared cork. Check for\ntmp directly so a changed psock->cork cannot turn a shared message into\nan apparent local one.","publishedAt":"2026-08-10T12:02:16.572Z","updatedAt":"2026-10-19T20:58:59.373Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"0688e6fe599d2d39147ae9ece97944c6e1815ebf","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"b2bcbeabfd843d47468fa095b1bd08ddb90cf616","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"54be47e7cbb936429c3bbdfc526ea943954aaf80","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"ee762f684eefa59de34d9ed93cab08336e834f47","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"cde4d6bcd9b73073c66498f6723c7b364c4dbc18","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"786d690257ec7a0c839f8710456e444ce3f1348b","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"752b1159ed5d0c48fe169a3721b96660a9822aa1","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"2d66a033864e27ab8d5e44cb36f31d9d2413bee4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_bpf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.20","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.20","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_bpf.c"]}],"references":["https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf","https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616","https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80","https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47","https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18","https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b","https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1","https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68284.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68284","state":"PUBLISHED","datePublished":"2026-08-10T12:02:16.572Z","dateUpdated":"2026-10-19T20:58:59.373Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.379Z"},"containers":{"cna":{"title":"bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()\n\ntcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which\ndrops and reacquires the socket lock.  Its error path tries to decide\nwhether msg_tx names the local temporary message by comparing it with\nthe current value of psock->cork.\n\nThis comparison is unsafe when two threads send on the same socket:\n\n  Thread A                         Thread B\n  msg_tx = psock->cork\n  sk_msg_alloc() fails\n  sk_stream_wait_memory()\n    releases the socket lock      acquires the socket lock\n                                  completes the cork\n                                  psock->cork = NULL\n                                  frees the cork\n    reacquires the socket lock\n  msg_tx != psock->cork\n  sk_msg_free(msg_tx)\n\nThe stale cork is therefore mistaken for the local temporary message\nand freed again.  KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50\n  Read of size 4 at addr ffff88810c908800 by task poc/90\n  Call Trace:\n   sk_msg_free+0x49/0x50\n   tcp_bpf_sendmsg+0x14f5/0x1cc0\n   __sys_sendto+0x32c/0x3a0\n   __x64_sys_sendto+0xdb/0x1b0\n  Allocated by task 89:\n   __kasan_kmalloc+0x8f/0xa0\n   tcp_bpf_sendmsg+0x16b3/0x1cc0\n  Freed by task 91:\n   __kasan_slab_free+0x43/0x70\n   kfree+0x131/0x3c0\n   tcp_bpf_sendmsg+0xec3/0x1cc0\n\nmsg_tx can only name the stack-local tmp or the shared cork. Check for\ntmp directly so a changed psock->cork cannot turn a shared message into\nan apparent local one."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"0688e6fe599d2d39147ae9ece97944c6e1815ebf","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"b2bcbeabfd843d47468fa095b1bd08ddb90cf616","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"54be47e7cbb936429c3bbdfc526ea943954aaf80","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"ee762f684eefa59de34d9ed93cab08336e834f47","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"cde4d6bcd9b73073c66498f6723c7b364c4dbc18","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"786d690257ec7a0c839f8710456e444ce3f1348b","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"752b1159ed5d0c48fe169a3721b96660a9822aa1","versionType":"git"},{"version":"604326b41a6fb9b4a78b6179335decee0365cd8c","status":"affected","lessThan":"2d66a033864e27ab8d5e44cb36f31d9d2413bee4","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_bpf.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"4.20","status":"affected"},{"version":"0","status":"unaffected","lessThan":"4.20","versionType":"semver"},{"version":"5.10.265","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.216","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.183","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.148","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.101","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.42","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_bpf.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf"},{"url":"https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616"},{"url":"https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80"},{"url":"https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47"},{"url":"https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18"},{"url":"https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b"},{"url":"https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1"},{"url":"https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered by local `sendmsg()`/`sendto()` syscalls issued concurrently by two threads on the same TCP socket attached to a BPF sockmap; the remote peer cannot drive the race, so this is a local attack surface.\nAC:L - The attacker controls both sides of the race: it owns both sending threads, can force the `wait_for_memory` path deterministically with a small SO_SNDBUF plus a large blocking send, and can force `sk_stream_wait_memory()` to fail via SO_SNDTIMEO or a socket error, making the stale-cork free reliably reachable.\nPR:L - Once the sockmap and sk_msg verdict/cork program are installed by the platform (a standard deployment such as Cilium/Istio sockops acceleration), an ordinary unprivileged local process owning a socket in the map triggers the bug with plain send syscalls; no capability check guards `tcp_bpf_sendmsg()` itself.\nUI:N - The attacker's own two threads perform all the required sends; no action by any other user or victim process is needed.\nS:U - The use-after-free corrupts kernel slab and page state within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - `sk_msg_free()` reads the freed `sk_msg` cork object (KASAN slab-use-after-free read), and by reclaiming that slab object with attacker-groomed data the freed scatterlist can be steered to leak or expose arbitrary kernel memory contents.\nI:H - Beyond the stale read, the path re-frees the cork's scatterlist pages and uncharges socket memory, giving a double-free/page-refcount-underflow primitive on an attacker-groomable slab object, which is classically leveraged into arbitrary kernel write and control-flow hijack.\nA:H - The use-after-free and duplicate page release corrupt slab and page allocator state, reliably producing a kernel oops or panic and taking the whole system down."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-19T16:32:41.174Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.6.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.20","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-68284","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:46:33.864710Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:58:59.373Z"}}]}}}