Skip to main content

Linux Kernel CVE-2026-68399

| EUVDEUVD-2026-55585 HIGH
2026-08-10 Linux GHSA-f9jq-9v6w-22v9
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local-only attack vector requiring user-level privileges to attach BPF storage; UAF yields full kernel C/I/A impact with low complexity once local access is obtained.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:44 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:04 cve.org
HIGH 7.8
CVE Published
Aug 10, 2026 - 12:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF in sock clone early bailouts

Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.

If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket.

Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().

AnalysisAI

Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.

Technical ContextAI

The vulnerability resides in the Linux kernel's BPF (Berkeley Packet Filter) local socket storage subsystem, introduced in kernel 5.2 when BPF per-socket storage was added. The root cause is a classic CWE-416 (Use-After-Free) triggered by incomplete initialization during error handling. The socket cloning function sk_clone() calls sock_copy() which performs a shallow bitwise copy of the parent socket struct, including the sk_bpf_storage pointer. The code assumes bpf_sk_storage_clone() will subsequently deep-copy or reinitialize this field. However, if sk_filter_charge() fails and sk_clone() returns early, bpf_sk_storage_clone() is never called, leaving newsk->sk_bpf_storage aliasing the parent's live storage. The deallocation path __sk_destruct() -> bpf_sk_storage_free() then frees the parent socket's BPF storage map while the parent socket is still in use. This is analogous to the previously patched commit 9b51a6155d14 ('bpf,fork: wipe ->bpf_storage before bailouts that access it') which addressed the same pattern in the fork path. CPE affected: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to Linux kernel 7.1.6 or 7.2-rc4 or later, which resolve the issue by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), eliminating the aliased pointer before any early bailout path is reachable. Stable-branch patches are available at https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e and https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f. Distribution users should apply their vendor's kernel update as soon as it incorporates these commits. As a compensating control where immediate patching is not possible, restricting unprivileged access to BPF via sysctl net.core.bpf_jit_enable=0 and setting kernel.unprivileged_bpf_disabled=1 limits which users can manipulate BPF socket storage, raising the privilege bar for exploitation - note this may break containerized workloads or monitoring tools relying on unprivileged BPF. Additional advisory detail is available at https://nvd.nist.gov/vuln/detail/CVE-2026-68399.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68399 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy