CVE-2026-74714

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74714", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.928Z", "datePublished": "2026-08-22T15:33:09.643Z", "dateUpdated": "2026-10-16T19:16:11.358Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:57.341Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt > 0. That assumption does not hold for\nrequest_sock:\n\n CPU 0 CPU 1\n ----- -----\n tcp_conn_request()\n reqsk_queue_hash_req()\n inet_ehash_insert(req)\n spin_lock(bucket)\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\n spin_unlock(bucket)\n bpf_iter_tcp_established_batch()\n spin_lock(bucket)\n sock_hold(req) <-- addition on 0\n spin_unlock(bucket)\n refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value\n\nwhich surfaces as:\n\n refcount_t: addition on 0; use-after-free.\n WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n Call Trace:\n bpf_iter_tcp_established_batch+0x14e/0x170\n bpf_iter_tcp_batch+0x53/0x200\n bpf_iter_tcp_seq_next+0x27/0x70\n bpf_seq_read+0x107/0x410\n vfs_read+0xb9/0x380\n\nThe iterator's stolen reference is lost when the publishing CPU's\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter->batch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - bpf_iter_tcp_established_batch() is reached only via local bpf() to load a BPF_TRACE_ITER TCP program, create an iterator link/fd, and read() it (bpf_seq_read->bpf_iter_tcp_batch); per kernel CNA guidance BPF iterator paths are Local even though concurrent TCP_NEW_SYN_RECV creation can be driven by network SYNs.\nAC:L - The fix commit reproduces in seconds with threads doing connect()/close() while others read iter/tcp in a tight loop; the attacker controls both the BPF iterator and TCP connection churn, so the refcount race between sock_hold() and refcount_set() is reliably winnable without uncontrollable victim state.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low privileges because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - No victim interaction is required; the attacker loads their own iter/tcp BPF program and link, then triggers the race with self-generated connect/close traffic or SYN activity to listeners in the iterated network namespace.\nS:U - Impact is a kernel heap use-after-free and memory corruption within the same host kernel security authority; this is standard local kernel compromise/crash, not a VM escape, sandbox boundary cross, or IOMMU bypass.\nC:H - The iterator retains dangling request_sock pointers after refcount_set() clobbers a sock_hold() taken on sk_refcnt==0; subsequent bpf_iter_tcp_seq_show/put_batch dereference freed kernel objects, giving UAF read primitives per kernel CNA UAF guidance.\nI:H - Freed request_sock slabs can be reallocated while the iterator batch still references them; UAF enables corrupted socket metadata, refcount abuse, and control-flow hijacking via heap grooming, meeting High integrity under kernel CNA memory-corruption guidance.\nA:H - The bug surfaces as refcount_warn_saturate and leaves the reqsk one reference short so it is freed while still reachable from the iterator batch, causing kernel oops/panic; the tight-loop repro shows reliable, repeatable host denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_ipv4.c"], "versions": [{"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_ipv4.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"}, {"url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"}, {"url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"}, {"url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"}, {"url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"}, {"url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"}], "title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:26.338787Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:11.358Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74714", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.928Z", "datePublished": "2026-08-22T15:33:09.643Z", "dateUpdated": "2026-10-16T19:16:11.358Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:57.341Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt > 0. That assumption does not hold for\nrequest_sock:\n\n CPU 0 CPU 1\n ----- -----\n tcp_conn_request()\n reqsk_queue_hash_req()\n inet_ehash_insert(req)\n spin_lock(bucket)\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\n spin_unlock(bucket)\n bpf_iter_tcp_established_batch()\n spin_lock(bucket)\n sock_hold(req) <-- addition on 0\n spin_unlock(bucket)\n refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value\n\nwhich surfaces as:\n\n refcount_t: addition on 0; use-after-free.\n WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n Call Trace:\n bpf_iter_tcp_established_batch+0x14e/0x170\n bpf_iter_tcp_batch+0x53/0x200\n bpf_iter_tcp_seq_next+0x27/0x70\n bpf_seq_read+0x107/0x410\n vfs_read+0xb9/0x380\n\nThe iterator's stolen reference is lost when the publishing CPU's\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter->batch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - bpf_iter_tcp_established_batch() is reached only via local bpf() to load a BPF_TRACE_ITER TCP program, create an iterator link/fd, and read() it (bpf_seq_read->bpf_iter_tcp_batch); per kernel CNA guidance BPF iterator paths are Local even though concurrent TCP_NEW_SYN_RECV creation can be driven by network SYNs.\nAC:L - The fix commit reproduces in seconds with threads doing connect()/close() while others read iter/tcp in a tight loop; the attacker controls both the BPF iterator and TCP connection churn, so the refcount race between sock_hold() and refcount_set() is reliably winnable without uncontrollable victim state.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low privileges because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - No victim interaction is required; the attacker loads their own iter/tcp BPF program and link, then triggers the race with self-generated connect/close traffic or SYN activity to listeners in the iterated network namespace.\nS:U - Impact is a kernel heap use-after-free and memory corruption within the same host kernel security authority; this is standard local kernel compromise/crash, not a VM escape, sandbox boundary cross, or IOMMU bypass.\nC:H - The iterator retains dangling request_sock pointers after refcount_set() clobbers a sock_hold() taken on sk_refcnt==0; subsequent bpf_iter_tcp_seq_show/put_batch dereference freed kernel objects, giving UAF read primitives per kernel CNA UAF guidance.\nI:H - Freed request_sock slabs can be reallocated while the iterator batch still references them; UAF enables corrupted socket metadata, refcount abuse, and control-flow hijacking via heap grooming, meeting High integrity under kernel CNA memory-corruption guidance.\nA:H - The bug surfaces as refcount_warn_saturate and leaves the reqsk one reference short so it is freed while still reachable from the iterator batch, causing kernel oops/panic; the tight-loop repro shows reliable, repeatable host denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_ipv4.c"], "versions": [{"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396", "status": "affected", "versionType": "git"}, {"version": "04c7820b776f1c4b48698574c47de9e940d368e8", "lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_ipv4.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"}, {"url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"}, {"url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"}, {"url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"}, {"url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"}, {"url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"}], "title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:15:26.338787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:15:27.200Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp_ipv4.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24", "status": "affected", "version": "04c7820b776f1c4b48698574c47de9e940d368e8", "versionType": "git"}, {"lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74", "status": "affected", "version": "04c7820b776f1c4b48698574c47de9e940d368e8", "versionType": "git"}, {"lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd", "status": "affected", "version": "04c7820b776f1c4b48698574c47de9e940d368e8", "versionType": "git"}, {"lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df", "status": "affected", "version": "04c7820b776f1c4b48698574c47de9e940d368e8", "versionType": "git"}, {"lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396", "status": "affected", "version": "04c7820b776f1c4b48698574c47de9e940d368e8", "versionType": "git"}, {"lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51", "status": "affected", "version": "04c7820b776f1c4b48698574c47de9e940d368e8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp_ipv4.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt > 0. That assumption does not hold for\nrequest_sock:\n\n CPU 0 CPU 1\n ----- -----\n tcp_conn_request()\n reqsk_queue_hash_req()\n inet_ehash_insert(req)\n spin_lock(bucket)\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\n spin_unlock(bucket)\n bpf_iter_tcp_established_batch()\n spin_lock(bucket)\n sock_hold(req) <-- addition on 0\n spin_unlock(bucket)\n refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value\n\nwhich surfaces as:\n\n refcount_t: addition on 0; use-after-free.\n WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n Call Trace:\n bpf_iter_tcp_established_batch+0x14e/0x170\n bpf_iter_tcp_batch+0x53/0x200\n bpf_iter_tcp_seq_next+0x27/0x70\n bpf_seq_read+0x107/0x410\n vfs_read+0xb9/0x380\n\nThe iterator's stolen reference is lost when the publishing CPU's\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter->batch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: tcp: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publica un request_sock TCP_NEW_SYN_RECV en la cadena ehash, libera el bloqueo del bucket, y solo despu\u00e9s establece rsk_refcnt en 3.\n\nLectores sin bloqueo como __inet_lookup_established() manejan esto con refcount_inc_not_zero(), pero bpf_iter_tcp_established_batch() usa un sock_hold() simple mientras mantiene el bloqueo del bucket, bajo la suposici\u00f3n de que el bloqueo garantiza sk_refcnt > 0. Esa suposici\u00f3n no se cumple para request_sock:\n\n CPU 0 CPU 1\n ----- -----\n tcp_conn_request()\n reqsk_queue_hash_req()\n inet_ehash_insert(req)\n spin_lock(bucket)\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\n spin_unlock(bucket)\n bpf_iter_tcp_established_batch()\n spin_lock(bucket)\n sock_hold(req) <- - adici\u00f3n en 0\n spin_unlock(bucket)\n refcount_set(&req -> rsk_refcnt, 3) // sobrescribe el valor saturado\n\nlo que se manifiesta como:\n\n refcount_t: adici\u00f3n en 0; uso despu\u00e9s de liberaci\u00f3n.\n ADVERTENCIA: lib/refcount.c:25 en refcount_warn_saturate+0x48/0x90, CPU#1\n Ruta de Llamada:\n bpf_iter_tcp_established_batch+0x14e/0x170\n bpf_iter_tcp_batch+0x53/0x200\n bpf_iter_tcp_seq_next+0x27/0x70\n bpf_seq_read+0x107/0x410\n vfs_read+0xb9/0x380\n\nLa referencia robada del iterador se pierde cuando el refcount_set() de la CPU publicadora sobrescribe el contador, dejando al socket con una referencia menos. Cuando el \u00faltimo propietario leg\u00edtimo libera su referencia, el reqsk es liberado mientras a\u00fan es accesible, lo que lleva a un uso despu\u00e9s de liberaci\u00f3n.\n\nEsto se reproduce en segundos con tcp_syncookies=0, un pu\u00f1ado de hilos realizando connect()/close() a un oyente local mientras otros leen un enlace iter/tcp en un bucle cerrado.\n\nUse refcount_inc_not_zero() y omita el socket en caso de fallo. Un socket omitido sigue siendo parte del bucket, as\u00ed que siga cont\u00e1ndolo en 'expected'. Las reasignaciones se dimensionan a partir de 'expected', y un request sock cuyo refcount se publica mientras el bloqueo se mantiene durante la \u00faltima reasignaci\u00f3n ya debe tener espacio.\n\nUn socket omitido se cuenta en 'expected' pero nunca se procesa en lotes, por lo que end_sk puede ser menor que 'expected' en un lote que en realidad est\u00e1 completo. Decida la completitud seg\u00fan si el recorrido dej\u00f3 alg\u00fan socket atr\u00e1s en su lugar. La ADVERTENCIA despu\u00e9s de la reasignaci\u00f3n bloqueada verifica lo mismo, reemplazando una verificaci\u00f3n de end_sk == expected que no pod\u00eda mantenerse en esa ruta desde el commit cdec67a489d4 ('bpf: tcp: Aseg\u00farese de que iter -> batch siempre contenga una instant\u00e1nea completa del bucket').\n\nSi cada socket coincidente en un bucket est\u00e1 en medio de la inicializaci\u00f3n (refcount 0), end_sk permanece en 0. Avance al siguiente bucket en lugar de devolver una entrada de lote que nunca se llen\u00f3 en esta ronda."}], "id": "CVE-2026-74714", "lastModified": "2026-10-16T20:17:54.033", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74714", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:15:26.338787Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:46.170", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()", "id": "2521378", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521378"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-911", "details": ["A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the `bpf_iter_tcp_established_batch()` function. This flaw occurs because the `sock_hold()` function is used on a `request_sock` object whose reference count can be zero, leading to an incorrect reference count. A local attacker can trigger this by performing specific network operations while reading an iterator/TCP link, potentially leading to a denial of service."], "name": "CVE-2026-74714", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74714\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74714\nhttps://lore.kernel.org/linux-cve-announce/2026082238-CVE-2026-74714-2ea9@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04c7820b776f1c4b48698574c47de9e940d368e8,cc0295f89296ed351fc4b0b48fee887ba02c5d24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04c7820b776f1c4b48698574c47de9e940d368e8,ddbe966b5d1fe212ada749bc3d0b410f1a7dea74)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04c7820b776f1c4b48698574c47de9e940d368e8,7d2b60a4bc0499f62ff8520af6309bbe170882fd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04c7820b776f1c4b48698574c47de9e940d368e8,cefcbbe20846a45f9a7dae868f7ef1000953e2df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04c7820b776f1c4b48698574c47de9e940d368e8,97e74d3e45d653c07c2d406fc530a9bbe3df8396)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[04c7820b776f1c4b48698574c47de9e940d368e8,e5fd3f514e27db1f05fbd72ba615d74941e23c51)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:30:16.837674+00:00", "updated": "2026-08-25T08:00:13.900798+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}