Look up another CVE · open CVE-2026-74589 in the interactive tracker
CVE-2026-74589
bpf, sockmap: Fix sk_redir use-after-free in send verdict
Published 2026-08-22 (2 months ago) by the Linux kernel CNA. Subsystem net/ipv4. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74589 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.9-1 | Update the kernel and reboot. Fixed in 7.1.9-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcp_bpf_sendmsg_redir(). When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket can consume the remaining bytes and release the cached reference while the first thread still holds only the raw local pointer: CPU 0 CPU 1 sk_redir = psock->sk_redir apply_bytes remains nonzero release_sock(sk) lock_sock(sk) apply_bytes reaches zero psock->sk_redir = NULL release_sock(sk) tcp_bpf_sendmsg_redir(sk_redir) sock_put(sk_redir) tcp_bpf_sendmsg_redir(sk_redir) The final sock_put() can free sk_redir before CPU 0 dereferences it. KASAN reported: BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020 Read of size 8 at addr ffff888108537090 by task poc/87 Call Trace: tcp_bpf_sendmsg_redir+0xf39/0x1020 tcp_bpf_sendmsg+0x977/0x1a50 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 85: sk_prot_alloc+0x56/0x210 sk_clone+0x6f/0x14b0 inet_csk_clone_lock+0x24/0x740 tcp_create_openreq_child+0x25/0x2710 tcp_v4_syn_recv_sock+0x10a/0xe00 Freed by task 0: __kasan_slab_free+0x43/0x70 slab_free_after_rcu_debug+0xa6/0x1e0 rcu_core+0x50a/0x1850 Last potentially related work creation: __sk_destruct+0x3da/0x540 sk_psock_destroy+0x81e/0xab0 process_one_work+0x63a/0x1070 Take a temporary socket reference while the source socket lock still protects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir() returns. This keeps each unlocked use independent of cached-verdict ownership.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ipv4/tcp_bpf.c
- What this is
- BPF [L7 FRAMEWORK] (sockmap)MAINTAINERS section matched on net/ipv4/tcp_bpf.c · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -wE 'CONFIG_INET|CONFIG_NET_SOCK_MSG' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sid, bookworm · linux-6.12y
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switches
- CONFIG_INET, CONFIG_NET_SOCK_MSG
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-22 (2 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ipv4
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.20 | 5.10.265 | 41b7da0cb72c |
| 4.20 | 5.15.216 | 9b4fbc371a6e |
| 4.20 | 6.1.183 | 90a19b0894ba |
| 4.20 | 6.6.152 | d192cff2a37d |
| 4.20 | 6.12.104 | 4c9d9aa809c2 |
| 4.20 | 6.18.45 | a14e4ef1d90c |
| 4.20 | 7.1.9 | 1cec526cf0a2 |
| 4.20 | 7.2 | a76624733730 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is reached via local sendmsg/sendto on a TCP socket whose ->sendmsg was replaced by tcp_bpf_sendmsg() after BPF sockmap SK_MSG verdict attachment; per kernel CNA BPF/sockmap guidance this path is Local even when remote peers drive outbound traffic on internet-facing eBPF proxies.
- AC:LAttack complexity, low
- The race needs two concurrent sendmsg() calls on the same sockmap-attached source socket while a cached __SK_REDIRECT verdict still has nonzero apply_bytes; the attacker controls both racing threads locally or can reliably create them on a multi-threaded server with concurrent client requests.
- PR:NPrivileges required, none
- The highest-impact reasonable deployment is an internet-facing Cilium/service-mesh node with pre-installed sockmap SK_MSG redirect programs; an unauthenticated remote client can trigger concurrent outbound sends on enrolled sockets without any privileges on the victim host, while self-setup only raises the bar to CAP_NET_ADMIN in a user namespace.
- UI:NUser interaction, none
- Exploitation requires only network traffic to a vulnerable proxy or the attacker's own concurrent sendmsg threads; no victim user action such as mounting filesystems, opening files, or clicking links is needed.
- S:UScope, unchanged
- The slab use-after-free corrupts a struct sock in the host kernel security authority and enables standard kernel memory corruption or privilege escalation; it does not by itself cross VM, IOMMU, or container sandbox boundaries.
- C:HConfidentiality impact, high
- KASAN reported slab-use-after-free in tcp_bpf_sendmsg_redir() with an 8-byte read through a freed struct sock; reclaiming that socket object enables attacker-controlled contents and arbitrary kernel memory disclosure via subsequent dereferences.
- I:HIntegrity impact, high
- Use-after-free on struct sock provides groomable heap control over sk_prot and callback pointers in tcp_bpf_sendmsg_redir(), yielding standard kernel UAF write primitives usable for arbitrary modification and privilege escalation.
- A:HAvailability impact, high
- The published KASAN trace shows deterministic slab-use-after-free during send verdict redirect processing; UAF on struct sock can oops or panic the kernel during dereference even when full exploitation is not attempted.