CVE-2026-68386

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68386", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.388Z", "datePublished": "2026-08-10T12:04:05.306Z", "dateUpdated": "2026-11-06T16:55:15.101Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:34:40.363Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket's refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n comm \"test_progs\", pid 2451, jiffies 4295320596\n hex dump (first 32 bytes):\n 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................\n 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............\n backtrace (crc bdee079d):\n kmem_cache_alloc_noprof+0x557/0x660\n sk_prot_alloc+0x69/0x240\n sk_alloc+0x30/0x460\n inet_create+0x2ce/0xf80\n __sock_create+0x25b/0x5c0\n __sys_socket+0x119/0x1d0\n __x64_sys_socket+0x72/0xd0\n do_syscall_64+0xa1/0x5f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/sock_map.c"], "versions": [{"version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608", "status": "affected", "versionType": "git"}, {"version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2", "status": "affected", "versionType": "git"}, {"version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5", "status": "affected", "versionType": "git"}, {"version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a", "status": "affected", "versionType": "git"}, {"version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "8692655da369961128658cf8539334b6a960ecb0", "status": "affected", "versionType": "git"}, {"version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/sock_map.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.148", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608"}, {"url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2"}, {"url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5"}, {"url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a"}, {"url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0"}, {"url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7"}], "title": "bpf, sockmap: Reject unhashed UDP sockets on sockmap update", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:48:28.442498Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:55:15.101Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-68386", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T16:48:28.442498Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T16:48:29.845Z"}}], "cna": {"title": "bpf, sockmap: Reject unhashed UDP sockets on sockmap update", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608", "versionType": "git"}, {"status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2", "versionType": "git"}, {"status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5", "versionType": "git"}, {"status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a", "versionType": "git"}, {"status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "8692655da369961128658cf8539334b6a960ecb0", "versionType": "git"}, {"status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7", "versionType": "git"}], "programFiles": ["net/core/sock_map.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/core/sock_map.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608"}, {"url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2"}, {"url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5"}, {"url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a"}, {"url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0"}, {"url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket's refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n comm \"test_progs\", pid 2451, jiffies 4295320596\n hex dump (first 32 bytes):\n 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................\n 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............\n backtrace (crc bdee079d):\n kmem_cache_alloc_noprof+0x557/0x660\n sk_prot_alloc+0x69/0x240\n sk_alloc+0x30/0x460\n inet_create+0x2ce/0xf80\n __sock_create+0x25b/0x5c0\n __sys_socket+0x119/0x1d0\n __x64_sys_socket+0x72/0xd0\n do_syscall_64+0xa1/0x5f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.148", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.101", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.42", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.6", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:34:40.363Z"}}}, "cveMetadata": {"cveId": "CVE-2026-68386", "state": "PUBLISHED", "dateUpdated": "2026-11-06T16:55:15.101Z", "dateReserved": "2026-07-30T09:28:09.388Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-10T12:04:05.306Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/sock_map.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608", "status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "versionType": "git"}, {"lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2", "status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "versionType": "git"}, {"lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5", "status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "versionType": "git"}, {"lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a", "status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "versionType": "git"}, {"lessThan": "8692655da369961128658cf8539334b6a960ecb0", "status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "versionType": "git"}, {"lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7", "status": "affected", "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/sock_map.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.148", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket's refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n comm \"test_progs\", pid 2451, jiffies 4295320596\n hex dump (first 32 bytes):\n 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................\n 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............\n backtrace (crc bdee079d):\n kmem_cache_alloc_noprof+0x557/0x660\n sk_prot_alloc+0x69/0x240\n sk_alloc+0x30/0x460\n inet_create+0x2ce/0xf80\n __sock_create+0x25b/0x5c0\n __sys_socket+0x119/0x1d0\n __x64_sys_socket+0x72/0xd0\n do_syscall_64+0xa1/0x5f0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."}], "id": "CVE-2026-68386", "lastModified": "2026-11-06T17:19:31.233", "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-68386", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T16:48:28.442498Z", "version": "2.0.3"}}]}, "published": "2026-08-10T13:20:31.823", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf, sockmap: Reject unhashed UDP sockets on sockmap update", "id": "2513442", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513442"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket's refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\nunreferenced object 0xffff88810bc2eb40 (size 1984):\ncomm \"test_progs\", pid 2451, jiffies 4295320596\nhex dump (first 32 bytes):\n7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................\n02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............\nbacktrace (crc bdee079d):\nkmem_cache_alloc_noprof+0x557/0x660\nsk_prot_alloc+0x69/0x240\nsk_alloc+0x30/0x460\ninet_create+0x2ce/0xf80\n__sock_create+0x25b/0x5c0\n__sys_socket+0x119/0x1d0\n__x64_sys_socket+0x72/0xd0\ndo_syscall_64+0xa1/0x5f0\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\nhandler for BPF sockmap usage\"), the proto::unhash BPF handler is not\nreintroduced.\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\").", "A flaw was found in the Linux kernel. A local attacker with BPF program capabilities could exploit a vulnerability in the BPF sockmap feature. This occurs when a BPF program increments the reference count of an unbound UDP socket, and the socket is subsequently bound. This sequence of events causes the `bpf_sk_release()` function to skip decrementing the reference count, leading to a memory leak."], "name": "CVE-2026-68386", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-10T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68386\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68386\nhttps://lore.kernel.org/linux-cve-announce/2026081045-CVE-2026-68386-c6a5@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0c48eefae712c2fd91480346a07a1a9cd0f9470b,7ffe529e7127411806c8692fb1490f552c629dc2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0c48eefae712c2fd91480346a07a1a9cd0f9470b,17b7ef6b86112a4e61cee1e9009a4b318e3225c5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0c48eefae712c2fd91480346a07a1a9cd0f9470b,250474c69bc3fc48a5fc21d7c349f279caad947a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0c48eefae712c2fd91480346a07a1a9cd0f9470b,8692655da369961128658cf8539334b6a960ecb0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0c48eefae712c2fd91480346a07a1a9cd0f9470b,66efd3368ae10d05e08fbe6425b50fdec7186ac7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.148,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T16:30:05.110516+00:00", "updated": "2026-08-13T06:45:04.712452+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}