Look up another CVE · open CVE-2026-64575 in the interactive tracker
CVE-2026-64575
bpf: tcp: fix double sock release on batch realloc
Published 2026-08-05 (2 months ago) by the Linux kernel CNA. Subsystem net/ipv4. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64575 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.6-1 | Update the kernel and reboot. Fixed in 7.1.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers. bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr 0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv4/tcp_ipv4.c
- What this is
- NETWORKING [TCP]MAINTAINERS section matched on net/ipv4/tcp*.c · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_INET /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_INET
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-05 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.12%, higher than 1.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/ipv4
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.1.183 | 6.1.183 | c842882e4c5d |
| 6.6.152 | 6.6.152 | 7a6a6d2a1278 |
| 6.12.104 | 6.12.104 | f0c1810320b0 |
| 6.17 | 6.18.42 | 9f27c4f0ae35 |
| 6.17 | 7.1.6 | 8a726e9585ff |
| 6.17 | 7.2 | 980a81345275 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Reached only through local bpf() syscalls that load a BPF_TRACE_ITER TCP program, create an iterator fd, and read it; bpf_seq_read drives bpf_iter_tcp_batch/stop. Per guidance BPF subsystem bugs are Local, not network-reachable.
- AC:LAttack complexity, low
- The attacker controls both prerequisites: creating more than INIT_BATCH_SZ TCP sockets in one hash bucket to force bpf_iter_tcp_put_batch-then-realloc, and inducing GFP_USER -ENOMEM (memory pressure/cgroup limits) so the failure path runs without races outside their control.
- PR:LPrivileges required, low
- Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON, which BPF tokens can delegate into a non-init user namespace; consistent with other BPF iterator CVEs this is Low rather than full init-namespace root.
- UI:NUser interaction, none
- The attacker loads their own TCP iterator program and triggers the bug by reading their iterator fd; no victim action such as mounting, opening a file, or interacting with the attacker is required.
- S:UScope, unchanged
- Impact is kernel memory corruption and panic within the same host kernel security authority; this is a standard local kernel bug, not a VM/hypervisor escape or IOMMU boundary bypass.
- C:HConfidentiality impact, high
- stop() re-enters bpf_iter_tcp_put_batch and treats stored socket cookies as struct sock pointers, so sock_gen_cookie performs an out-of-bounds/wild kernel read; type-confused pointer dereference supports high confidentiality impact under the higher-severity rule.
- I:HIntegrity impact, high
- The same type confusion reaches sock_gen_put, which decrements sk_refcnt and may free through the forged pointer, yielding kernel memory corruption and a plausible control-flow/integrity primitive beyond a clean crash.
- A:HAvailability impact, high
- The reported path is a KASAN null-ptr-deref in __sock_gen_cookie during bpf_iter_tcp_seq_stop that ends in kernel panic; the attacker can repeat the iterator read to deny host availability.