Skip to main content

Linux Kernel CVE-2026-68284

| EUVDEUVD-2026-55385 HIGH
2026-08-10 Linux GHSA-f87h-88f3-m92w
Information Disclosure Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition requires concurrent sends under memory pressure (AC:H); PR:L applies when sockmap is pre-loaded by infrastructure; kernel UAF justifies C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:44 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:02 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_tx names the local temporary message by comparing it with the current value of psock->cork.

This comparison is unsafe when two threads send on the same socket:

Thread A Thread B msg_tx = psock->cork sk_msg_alloc() fails sk_stream_wait_memory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msg_tx != psock->cork sk_msg_free(msg_tx)

The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported:

BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: sk_msg_free+0x49/0x50 tcp_bpf_sendmsg+0x14f5/0x1cc0 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 89: __kasan_kmalloc+0x8f/0xa0 tcp_bpf_sendmsg+0x16b3/0x1cc0 Freed by task 91: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 tcp_bpf_sendmsg+0xec3/0x1cc0

msg_tx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one.

AnalysisAI

Use-after-free in the Linux kernel's BPF sockmap subsystem allows a local low-privileged attacker to corrupt kernel slab memory via a race condition in tcp_bpf_sendmsg(), potentially escalating privileges to root. The vulnerability arises because the error path in tcp_bpf_sendmsg() uses a stale msg_tx pointer to decide whether to free a shared cork object - a decision that becomes unsafe once a second thread has already freed it during the window when the socket lock is released by sk_stream_wait_memory(). No public exploit has been identified at time of analysis and EPSS is 0.18%, though KASAN telemetry in the disclosure confirms the bug was reproduced by the reporter.

Technical ContextAI

The vulnerability is in the Linux kernel's BPF sockmap TCP send path, specifically tcp_bpf_sendmsg() in net/core/filter (or equivalent BPF TCP hook layer). The cork mechanism aggregates partial send data into a single psock->cork message pointer shared across concurrent senders. The flaw is a classic TOCTOU race: msg_tx is set to psock->cork before sk_stream_wait_memory() releases the socket lock. During that lock-release window, a second thread can complete, free, and NULL-out psock->cork. When the first thread reacquires the lock, it compares msg_tx against the now-updated psock->cork; the values differ, so it incorrectly treats the stale pointer as a stack-local temporary and calls sk_msg_free() a second time, producing a slab-use-after-free. The root cause class is CWE-416 (Use After Free) compounded by CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization), though NVD has not assigned a CWE for this entry. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, introduced at commit 604326b41a6fb9b4a78b6179335decee0365cd8c and spanning all major stable series until the fix commits.

RemediationAI

Upgrade to a patched stable kernel release: 7.1.6, 6.18.42, 6.12.101, or 6.6.148 as appropriate for the deployed series, or 7.2-rc5 for development environments. Fix commits are available at https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47 and the four additional commits listed in the CVE references. For systems that cannot be immediately rebooted into a patched kernel, the primary compensating control is to remove or disable any BPF sockmap programs from TCP sockets: without a sockmap program attached, tcp_bpf_sendmsg() is not invoked and the vulnerable code path is unreachable. This trades off any BPF-based connection acceleration or policy enforcement provided by infrastructure components such as Cilium, but fully eliminates this attack surface. Systems running standard networking stacks without custom eBPF programs are not exposed to this specific path and face no additional risk beyond scheduling a routine kernel update.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68284 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy