Skip to main content

Linux Kernel CVE-2026-43016

| EUVDEUVD-2026-26615 HIGH
Use After Free (CWE-416)
2026-05-01 Linux
Information Disclosure Linux Google Use After Free Memory Corruption
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Gain local authenticated access
  2. Delivery
    Create BPF sockmap and attach verdict program
  3. Exploit
    Establish AF_UNIX socket pairs
  4. Install
    Trigger race condition via timed sendmsg and socket close
  5. C2
    Corrupt freed sk_socket memory
  6. Execute
    Redirect kernel execution flow
  7. Impact
    Execute arbitrary code as root

Vulnerability Assessment

Weakness
CWE
CWE-416
ASVS 5.0
V15 - Secure Coding and Architecture Memory lifecycle management
MITRE ATT&CK

2 techniques across 2 tactics: Execution, Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local authenticated access (PR:L) to a system running affected Linux kernel versions 5.15 through 6.19.11. System must have BPF sockmap functionality enabled (CONFIG_BPF_STREAM_PARSER kernel configuration option) and the attacker must have sufficient privileges to create BPF maps and attach BPF programs to sockets, typically requiring CAP_NET_ADMIN or CAP_BPF capabilities. The vulnerability is triggered specifically when using AF_UNIX stream sockets with BPF sockmap verdict programs attached. Default Linux installations have BPF enabled, but sockmap usage is not default and typically only deployed in container orchestration environments with eBPF-based networking (Kubernetes with Cilium, Istio service mesh, or similar). Successful exploitation requires winning a race condition between unix_stream_sendmsg() releasing locks and sock_orphan() freeing the sk_socket structure, making reliability dependent on system load and timing precision. Does not affect systems without BPF sockmap in active use or those running kernels compiled without BPF stream parser support.
Impact

Despite a CVSS base score of 7.8 (High severity), real-world risk is moderate and highly context-dependent. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity requiring low privileges, which limits remote exploitation scenarios. The EPSS score of 0.02% (5th percentile) suggests extremely low observed exploitation probability, consistent with the lack of public exploits or CISA KEV listing. However, the potential impact is severe: successful exploitation enables memory corruption in kernel context (C:H/I:H/A:H), potentially leading to privilege escalation, arbitrary code execution as root, or system crashes. The vulnerability specifically requires BPF sockmap to be in active use with AF_UNIX sockets, which is not a default configuration in most deployments but is common in containerized environments running service mesh solutions like Cilium or Istio. The availability of vendor patches across all affected stable kernel branches (6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline) significantly reduces risk for organizations following normal patching cycles. Priority should be elevated for systems running container orchestration platforms with eBPF-based networking, particularly those exposed to untrusted local users or containers. For general-purpose servers without BPF sockmap usage, this represents lower immediate risk despite the high CVSS score.
Exploit ScenarioDerived

An attacker with local authenticated access to a system running vulnerable kernel versions creates a BPF sockmap configuration and establishes AF_UNIX socket pairs. By carefully timing sendmsg() operations with socket closure and orphaning, the attacker triggers the race condition where sk_psock_verdict_data_ready() accesses freed sk_socket memory. Through heap manipulation techniques, the attacker controls the freed memory contents to redirect execution flow, achieving arbitrary kernel code execution and escalating to root privileges or compromising kernel integrity.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 03, 2026

Use-after-free in Linux kernel's BPF sockmap implementation allows local authenticated attackers to corrupt memory and potentially execute arbitrary code with kernel privileges. The vulnerability occurs in sk_psock_verdict_data_ready() when handling AF_UNIX sockets, where sk->sk_socket can be accessed after being freed following sock_orphan(). This affects Linux kernel versions 5.15 through 6.19.12, with patches available for stable branches 6.6.134, 6.12.81, 6.18.22, 6.19.12, and mainline 7.0. EPSS score of 0.02% indicates very low observed exploitation probability in the wild, and no active exploitation or public exploit code has been identified at time of analysis.

RemediationAI

Upgrade to patched Linux kernel versions: 6.6.134 or later for 6.6.x series, 6.12.81 or later for 6.12.x, 6.18.22 or later for 6.18.x, 6.19.12 or later for 6.19.x, or version 7.0 for mainline kernels. Vendor patches are available from kernel.org stable branches at the URLs listed in affected products section. For systems that cannot immediately patch, disable BPF sockmap functionality if not required by unloading the relevant kernel modules or rebuilding the kernel without CONFIG_BPF_STREAM_PARSER support, though this will break applications depending on BPF socket redirection such as Cilium, Istio, or other eBPF-based service meshes. Alternatively, restrict local user access and container capabilities to limit exposure, specifically dropping CAP_NET_ADMIN and CAP_BPF capabilities from unprivileged containers, though this provides incomplete protection as the vulnerability exists in kernel code paths. For container environments, consider temporary migration to alternative CNI plugins that do not rely on BPF sockmap until patching is completed. Note that disabling BPF entirely will impact observability tools, network policies, and performance optimizations in modern container platforms. Organizations should prioritize patching over workarounds due to the operational impact of mitigation alternatives.

Affected VersionsENISA

Linux patch: 7.0
Linux c63829182c37c2d6d0608976d15fa61ebebe9e6b <ad8391d37f334ee73ba91926f8b4e4cf6d31ea04
Linux c63829182c37c2d6d0608976d15fa61ebebe9e6b <68187f18a89be4b6237d28ae1313b5adf76238c6
Linux 5.15
Linux patch: 0
Linux patch: 6.19.12
Linux c63829182c37c2d6d0608976d15fa61ebebe9e6b <18861f87a043e78b1f901cae4237e755ed7ef095
Linux c63829182c37c2d6d0608976d15fa61ebebe9e6b <8d597e3e74027900ffa81b8ff47ab51999a3e110
Linux patch: 6.18.22
Linux c63829182c37c2d6d0608976d15fa61ebebe9e6b <af95bc39a83d82ae6ad253986335037256888b3f
Linux patch: 6.12.81
Linux patch: 6.6.134

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

This vulnerability exists in the Berkeley Packet Filter (BPF) sockmap subsystem, specifically in the socket message handling code (net/core/skmsg.c). BPF sockmap allows efficient redirection of socket traffic through BPF programs and is commonly used for service mesh implementations and socket-level load balancing. The issue stems from a race condition in unix_stream_sendmsg() where the peer socket's sk_data_ready() callback is invoked after releasing the unix_state_lock. While the sender holds a reference count on the peer socket structure itself, this does not prevent sock_orphan() from being called on the peer, which can free the sk_socket structure after one RCU grace period. The sk_psock_verdict_data_ready() function dereferences sk->sk_socket without proper RCU protection, leading to a use-after-free condition. The fix involves fetching sk->sk_socket and sk->sk_socket->ops under RCU read-side critical section to ensure the structure remains valid during access. This vulnerability was discovered through syzbot fuzzing and affects systems utilizing BPF sockmap functionality with AF_UNIX sockets.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 03, 2026 - 07:22 NVD
7.8 (HIGH)
Patch released
May 03, 2026 - 07:16 nvd
Patch available
Patch available
May 01, 2026 - 16:33 EUVD
CVE Published
May 01, 2026 - 14:15 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().

syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket in sk_psock_verdict_data_ready(). [0]

In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is called after dropping its unix_state_lock().

Although the sender socket holds the peer's refcount, it does not prevent the peer's sock_orphan(), and the peer's sk_socket might be freed after one RCU grace period.

Let's fetch the peer's sk->sk_socket and sk->sk_socket->ops under RCU in sk_psock_verdict_data_ready().

[0]: BUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278 Read of size 8 at addr ffff8880594da860 by task syz.4.1842/11013

CPU: 1 UID: 0 PID: 11013 Comm: syz.4.1842 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278 unix_stream_sendmsg+0x8a3/0xe80 net/unix/af_unix.c:2482 sock_sendmsg_nosec net/socket.c:721 [inline] __sock_sendmsg net/socket.c:736 [inline] ____sys_sendmsg+0x972/0x9f0 net/socket.c:2585 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2639 __sys_sendmsg net/socket.c:2671 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7facf899c819 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007facf9827028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007facf8c15fa0 RCX: 00007facf899c819 RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000004 RBP: 00007facf8a32c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007facf8c16038 R14: 00007facf8c15fa0 R15: 00007ffd41b01c78 </TASK>

Allocated by task 11013: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4538 [inline] slab_alloc_node mm/slub.c:4866 [inline] kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4885 sock_alloc_inode+0x28/0xc0 net/socket.c:316 alloc_inode+0x6a/0x1b0 fs/inode.c:347 new_inode_pseudo include/linux/fs.h:3003 [inline] sock_alloc net/socket.c:631 [inline] __sock_create+0x12d/0x9d0 net/socket.c:1562 sock_create net/socket.c:1656 [inline] __sys_socketpair+0x1c4/0x560 net/socket.c:1803 __do_sys_socketpair net/socket.c:1856 [inline] __se_sys_socketpair net/socket.c:1853 [inline] __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1853 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 15: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2685 [inline] slab_free mm/slub.c:6165 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6295 rcu_do_batch kernel/rcu/tree.c: ---truncated---

Executive ViewAI

Why It Matters

CVE-2026-43016 is a use-after-free vulnerability in the Linux kernel's BPF sockmap implementation that allows local authenticated users to achieve arbitrary code execution with kernel privileges. Organizations running vulnerable Linux kernel versions (5.15-6.19.12) face elevated risk of privilege escalation and system compromise, particularly in multi-tenant or shared computing environments where local access controls are critical.

Business Impact: High
Compensating Controls

Apply vendor patch. If immediate patching is not feasible, restrict local user access via mandatory access controls (AppArmor/SELinux), disable unprivileged BPF operations with kernel.unprivileged_bpf_disabled=1, and enforce process accounting to detect suspicious kernel-mode execution attempts.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Use After Free HIGH

Use-after-free vulnerabilities occur when a program continues to access memory through a pointer after that memory has been deallocated.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/360621 REF https://git.kernel.org/stable/c/18861f87a043e78b1f901cae4237e755ed7ef095 REF https://git.kernel.org/stable/c/68187f18a89be4b6237d28ae1313b5adf76238c6 REF https://git.kernel.org/stable/c/8d597e3e74027900ffa81b8ff47ab51999a3e110 REF https://git.kernel.org/stable/c/ac9f092e9994cada106432d5070e28ee9cb2fdac REF https://git.kernel.org/stable/c/ad8391d37f334ee73ba91926f8b4e4cf6d31ea04 REF https://git.kernel.org/stable/c/af95bc39a83d82ae6ad253986335037256888b3f

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy