CVE-2026-74589

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74589", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.918Z", "datePublished": "2026-08-22T15:31:41.177Z", "dateUpdated": "2026-10-16T19:05:59.193Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:16.327Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.4, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached via local sendmsg/sendto on a TCP socket whose ->sendmsg was replaced by tcp_bpf_sendmsg() after BPF sockmap SK_MSG verdict attachment; per kernel CNA BPF/sockmap guidance this path is Local even when remote peers drive outbound traffic on internet-facing eBPF proxies.\nAC:L - The race needs two concurrent sendmsg() calls on the same sockmap-attached source socket while a cached __SK_REDIRECT verdict still has nonzero apply_bytes; the attacker controls both racing threads locally or can reliably create them on a multi-threaded server with concurrent client requests.\nPR:N - The highest-impact reasonable deployment is an internet-facing Cilium/service-mesh node with pre-installed sockmap SK_MSG redirect programs; an unauthenticated remote client can trigger concurrent outbound sends on enrolled sockets without any privileges on the victim host, while self-setup only raises the bar to CAP_NET_ADMIN in a user namespace.\nUI:N - Exploitation requires only network traffic to a vulnerable proxy or the attacker's own concurrent sendmsg threads; no victim user action such as mounting filesystems, opening files, or clicking links is needed.\nS:U - The slab use-after-free corrupts a struct sock in the host kernel security authority and enables standard kernel memory corruption or privilege escalation; it does not by itself cross VM, IOMMU, or container sandbox boundaries.\nC:H - KASAN reported slab-use-after-free in tcp_bpf_sendmsg_redir() with an 8-byte read through a freed struct sock; reclaiming that socket object enables attacker-controlled contents and arbitrary kernel memory disclosure via subsequent dereferences.\nI:H - Use-after-free on struct sock provides groomable heap control over sk_prot and callback pointers in tcp_bpf_sendmsg_redir(), yielding standard kernel UAF write primitives usable for arbitrary modification and privilege escalation.\nA:H - The published KASAN trace shows deterministic slab-use-after-free during send verdict redirect processing; UAF on struct sock can oops or panic the kernel during dereference even when full exploitation is not attempted."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_bpf.c"], "versions": [{"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e", "status": "affected", "versionType": "git"}, {"version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "a76624733730e541e4955fdecf506af2f6b20558", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_bpf.c"], "versions": [{"version": "4.20", "status": "affected"}, {"version": "0", "lessThan": "4.20", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf"}, {"url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3"}, {"url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99"}, {"url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274"}, {"url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf"}, {"url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10"}, {"url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e"}, {"url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558"}], "title": "bpf, sockmap: Fix sk_redir use-after-free in send verdict", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:32.594795Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:59.193Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74589", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:32.594795Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:01:33.435Z"}}], "cna": {"title": "bpf, sockmap: Fix sk_redir use-after-free in send verdict", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached via local sendmsg/sendto on a TCP socket whose ->sendmsg was replaced by tcp_bpf_sendmsg() after BPF sockmap SK_MSG verdict attachment; per kernel CNA BPF/sockmap guidance this path is Local even when remote peers drive outbound traffic on internet-facing eBPF proxies.\nAC:L - The race needs two concurrent sendmsg() calls on the same sockmap-attached source socket while a cached __SK_REDIRECT verdict still has nonzero apply_bytes; the attacker controls both racing threads locally or can reliably create them on a multi-threaded server with concurrent client requests.\nPR:N - The highest-impact reasonable deployment is an internet-facing Cilium/service-mesh node with pre-installed sockmap SK_MSG redirect programs; an unauthenticated remote client can trigger concurrent outbound sends on enrolled sockets without any privileges on the victim host, while self-setup only raises the bar to CAP_NET_ADMIN in a user namespace.\nUI:N - Exploitation requires only network traffic to a vulnerable proxy or the attacker's own concurrent sendmsg threads; no victim user action such as mounting filesystems, opening files, or clicking links is needed.\nS:U - The slab use-after-free corrupts a struct sock in the host kernel security authority and enables standard kernel memory corruption or privilege escalation; it does not by itself cross VM, IOMMU, or container sandbox boundaries.\nC:H - KASAN reported slab-use-after-free in tcp_bpf_sendmsg_redir() with an 8-byte read through a freed struct sock; reclaiming that socket object enables attacker-controlled contents and arbitrary kernel memory disclosure via subsequent dereferences.\nI:H - Use-after-free on struct sock provides groomable heap control over sk_prot and callback pointers in tcp_bpf_sendmsg_redir(), yielding standard kernel UAF write primitives usable for arbitrary modification and privilege escalation.\nA:H - The published KASAN trace shows deterministic slab-use-after-free during send verdict redirect processing; UAF on struct sock can oops or panic the kernel during dereference even when full exploitation is not attempted."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e", "versionType": "git"}, {"status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "lessThan": "a76624733730e541e4955fdecf506af2f6b20558", "versionType": "git"}], "programFiles": ["net/ipv4/tcp_bpf.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"status": "unaffected", "version": "0", "lessThan": "4.20", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv4/tcp_bpf.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf"}, {"url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3"}, {"url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99"}, {"url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274"}, {"url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf"}, {"url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10"}, {"url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e"}, {"url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.20"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.20"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:16.327Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74589", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:59.193Z", "dateReserved": "2026-08-15T05:44:03.918Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:31:41.177Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp_bpf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}, {"lessThan": "a76624733730e541e4955fdecf506af2f6b20558", "status": "affected", "version": "604326b41a6fb9b4a78b6179335decee0365cd8c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp_bpf.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.20"}, {"lessThan": "4.20", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf, sockmap: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n de sk_redir en el veredicto de env\u00edo\n\nsk_psock_msg_verdict() toma una referencia de socket para psock -> sk_redir.\ntcp_bpf_send_verdict() copia ese puntero mientras mantiene el bloqueo del socket de origen, pero no toma una referencia para la copia local antes de liberar el bloqueo alrededor de tcp_bpf_sendmsg_redir().\n\nCuando apply_bytes mantiene activo el veredicto en cach\u00e9, otro sendmsg() en el mismo socket de origen puede consumir los bytes restantes y liberar la referencia en cach\u00e9 mientras el primer hilo a\u00fan mantiene solo el puntero local sin procesar:\n\n CPU 0 CPU 1\n sk_redir = psock -> sk_redir\n apply_bytes permanece distinto de cero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes llega a cero\n psock -> sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nEl sock_put() final puede liberar sk_redir antes de que la CPU 0 lo desreferencie.\n\nKASAN inform\u00f3:\n\n BUG: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en tcp_bpf_sendmsg_redir+0xf39/0x1020\n Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888108537090 por la tarea PoC/87\n Traza de Llamada:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Asignado por la tarea 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Liberado por la tarea 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n \u00daltima creaci\u00f3n de trabajo potencialmente relacionada:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nToma una referencia de socket temporal mientras el bloqueo del socket de origen a\u00fan protege psock -> sk_redir, y lib\u00e9rala despu\u00e9s de que tcp_bpf_sendmsg_redir() retorne. Esto mantiene cada uso desbloqueado independiente de la propiedad del veredicto en cach\u00e9."}], "id": "CVE-2026-74589", "lastModified": "2026-10-16T20:17:42.877", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74589", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:01:32.594795Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:31.097", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf, sockmap: Fix sk_redir use-after-free in send verdict", "id": "2521400", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521400"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\nCPU 0 CPU 1\nsk_redir = psock->sk_redir\napply_bytes remains nonzero\nrelease_sock(sk)\nlock_sock(sk)\napply_bytes reaches zero\npsock->sk_redir = NULL\nrelease_sock(sk)\ntcp_bpf_sendmsg_redir(sk_redir)\nsock_put(sk_redir)\ntcp_bpf_sendmsg_redir(sk_redir)\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\nKASAN reported:\nBUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\nRead of size 8 at addr ffff888108537090 by task poc/87\nCall Trace:\ntcp_bpf_sendmsg_redir+0xf39/0x1020\ntcp_bpf_sendmsg+0x977/0x1a50\n__sys_sendto+0x32c/0x3a0\n__x64_sys_sendto+0xdb/0x1b0\nAllocated by task 85:\nsk_prot_alloc+0x56/0x210\nsk_clone+0x6f/0x14b0\ninet_csk_clone_lock+0x24/0x740\ntcp_create_openreq_child+0x25/0x2710\ntcp_v4_syn_recv_sock+0x10a/0xe00\nFreed by task 0:\n__kasan_slab_free+0x43/0x70\nslab_free_after_rcu_debug+0xa6/0x1e0\nrcu_core+0x50a/0x1850\nLast potentially related work creation:\n__sk_destruct+0x3da/0x540\nsk_psock_destroy+0x81e/0xab0\nprocess_one_work+0x63a/0x1070\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership.", "A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) sockmap feature. A use-after-free vulnerability exists in the sk_redir mechanism within the tcp_bpf_sendmsg_redir() function. This occurs when a socket reference is prematurely released while another thread still holds a raw pointer to it, leading to memory corruption. An attacker could potentially exploit this to cause a denial of service or other unspecified impacts."], "name": "CVE-2026-74589", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74589\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74589\nhttps://lore.kernel.org/linux-cve-announce/2026082212-CVE-2026-74589-30de@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,90a19b0894ba79a699b48cf44421b36fbd566e99)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,d192cff2a37d59206dabe6ec2e60ceac6271f274)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,1cec526cf0a2227395f2c2f4b671cb052ff0b00e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[604326b41a6fb9b4a78b6179335decee0365cd8c,a76624733730e541e4955fdecf506af2f6b20558)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.20"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.20)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:45:03.650914+00:00", "updated": "2026-08-25T17:00:04.121497+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}