Skip to main content

Linux Kernel CVE-2026-74257

| EUVDEUVD-2026-59404 HIGH
2026-08-15 Linux GHSA-9q9r-2g23-7q72
Information Disclosure Linux Google
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify system with BPF sockmap active on UDP socket
  2. Delivery
    Obtain local low-privilege shell access
  3. Exploit
    Spawn concurrent recvmsg() threads on target socket
  4. Install
    Race sk_msg peek against free in udp_bpf_recvmsg()
  5. C2
    Trigger use-after-free read in sk_msg_recvmsg() at skmsg.c:428
  6. Execute
    Leak or corrupt freed kernel heap memory
  7. Impact
    Escalate privileges or crash kernel

Vulnerability Assessment

Exploitation Conditions

Exploitation requires all of the following: (1) local system access with at minimum low-privilege credentials, consistent with CVSS PR:L; (2) a UDP socket with an active BPF sockmap program attached via psock - this setup is non-default and typically requires CAP_NET_ADMIN or CAP_BPF privileges to configure, meaning a privileged process must have already established the sockmap context; (3) the ability to spawn multiple concurrent threads calling recvmsg() on that socket to win the race between sk_msg peek and free. Exploitation is limited by: the BPF sockmap requirement being non-default (not present in standard Linux deployments), the need for concurrent thread execution to win the race window, and the capability barrier to initially loading BPF programs. This is not exploitable against default Linux kernel configurations lacking sockmap use.
Impact

CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly characterizes this as a high-severity local vulnerability, but real-world exploitability is significantly constrained by several factors. EPSS is 0.17% at the 6th percentile, consistent with a kernel race condition that requires non-default configuration and concurrent exploitation. The vulnerability is absent from CISA KEV and no weaponized exploit has been published. Crucially, the exploitable condition - a UDP socket with an active BPF sockmap program attached - requires CAP_NET_ADMIN or CAP_BPF to configure, meaning a privileged actor must have set up sockmap before a low-privilege attacker can race the receive path. This creates a realistic attack scenario only in multi-tenant or container environments where sockmap is legitimately deployed by a higher-privilege process. The CVSS AC:L rating reflects syzbot's ability to reproducibly trigger the race; however, reliable kernel heap exploitation of a UAF to achieve privilege escalation in practice typically demands additional engineering beyond the memory corruption itself. Priority should be higher for cloud/container workloads using BPF-based networking, and lower for standard desktop or server deployments without sockmap in use.
Exploit ScenarioDerived

A local attacker on a Linux host where a privileged service has attached a BPF sockmap program to a UDP socket spawns multiple threads simultaneously issuing recvmsg() system calls on that socket. Two threads concurrently peek the same sk_msg from the psock ingress queue; thread A processes and frees the structure while thread B continues reading fields within the freed slab object at net/core/skmsg.c:428. The resulting use-after-free yields a kernel heap read that can be used to leak sensitive kernel memory or, with further exploitation, to corrupt adjacent heap objects and escalate to kernel-level code execution.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Aug 17, 2026

Use-after-free in the Linux kernel's BPF sockmap UDP receive path allows a local low-privileged attacker to corrupt kernel heap memory, enabling potential privilege escalation, kernel memory disclosure, or system crash. The race condition in udp_bpf_recvmsg() allows concurrent threads to access a sk_msg structure after it has been freed, because a prior refactor removed the lock_sock() serialization that TCP and AF_UNIX sockets retain. Discovered by Google's syzbot automated fuzzer on Google Compute Engine; no public exploit beyond that reproduction harness and no CISA KEV listing exist at time of analysis.

RemediationAI

Upgrade to a patched kernel version: Linux 6.18.40, 7.1.5, or 7.2-rc1 per EUVD-confirmed fix data. The fix re-introduces lock_sock() in udp_bpf_recvmsg() to serialize concurrent calls to sk_msg_recvmsg(), restoring parity with TCP and AF_UNIX paths. Patch commits are available at https://git.kernel.org/stable/c/81567d2b3f4dc4fc32f8b61433738bce2cafd4a1, https://git.kernel.org/stable/c/39d44ed6904bfa9a1c6d0538672dd50c7b85520e, and https://git.kernel.org/stable/c/c010995b29c8939c6aa69e3cb26f8dbee163d156. Where immediate patching is not feasible, restrict BPF program loading via sysctl net.core.bpf_jit_enable=0 or by setting kernel.unprivileged_bpf_disabled=1 to prevent unprivileged BPF sockmap setup; note this does not prevent root-level sockmap configuration and will disable other BPF-dependent features such as eBPF-based network monitoring tools. Alternatively, LSM policies (AppArmor or SELinux) can be used to restrict BPF syscall access to specific trusted processes only.

Affected VersionsENISA

Linux 9f2470fbc4cb4583c080bb729a998933ba61aca4 <39d44ed6904bfa9a1c6d0538672dd50c7b85520e
Linux 9f2470fbc4cb4583c080bb729a998933ba61aca4 <81567d2b3f4dc4fc32f8b61433738bce2cafd4a1
Linux 5.14
Linux patch: 0
Linux patch: 7.1.5
Linux patch: 6.18.40
Linux 9f2470fbc4cb4583c080bb729a998933ba61aca4 <c010995b29c8939c6aa69e3cb26f8dbee163d156
Linux patch: 7.2-rc1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in net/ipv4/udp_bpf.c and net/core/skmsg.c within the Linux kernel's BPF sockmap subsystem. Sockmap is a BPF map type enabling BPF programs to redirect socket traffic between sockets; incoming data is stored as sk_msg structures in a psock ingress queue. sk_msg_recvmsg() peeks a sk_msg from psock->ingress_msg under a spin lock but all subsequent processing - including copy_page_to_iter() which copies data to userspace - is lockless. TCP codepaths protect this critical section with lock_sock() and AF_UNIX uses unix_sk(sk)->iolock, but a cited prior commit removed lock_sock() from udp_bpf_recvmsg(), breaking the serialization invariant. When two threads concurrently call recvmsg() on the same BPF-sockmap-attached UDP socket, one can free sk_msg while the other is mid-read at skmsg.c:428, producing a KASAN-confirmed slab-use-after-free. The root cause class is CWE-416 (Use After Free) via an unprotected time-of-check/time-of-use race. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.8 HIGH

Local access with low privileges suffices to trigger the race; once sockmap is configured AC:L is appropriate given syzbot's reliable reproduction; full C/I/A from kernel heap UAF.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 05:57 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

sockmap: Fix use-after-free in udp_bpf_recvmsg()

syzbot reported use-after-free of struct sk_msg in sk_msg_recvmsg(). [0]

sk_msg_recvmsg() peeks sk_msg from psock->ingress_msg under a lock, but its processing is lockless.

Thus, sk_msg_recvmsg() must be serialised by callers, otherwise multiple threads could touch the same sk_msg.

For example, TCP uses lock_sock(), and AF_UNIX uses unix_sk(sk)->iolock.

Initially, udp_bpf_recvmsg() had used lock_sock(), but the cited commit removed it.

Let's serialise sk_msg_recvmsg() with lock_sock() in udp_bpf_recvmsg().

Note that holding spin_lock_bh(&sk->sk_receive_queue.lock) is not an option due to copy_page_to_iter() in sk_msg_recvmsg().

[0]: BUG: KASAN: slab-use-after-free in sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428 Read of size 4 at addr ffff88814cdcf000 by task syz.0.24/6020

CPU: 1 UID: 0 PID: 6020 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 sk_msg_recvmsg+0xb54/0xc30 net/core/skmsg.c:428 udp_bpf_recvmsg+0x4bd/0xe00 net/ipv4/udp_bpf.c:84 inet_recvmsg+0x260/0x270 net/ipv4/af_inet.c:891 sock_recvmsg_nosec net/socket.c:1078 [inline] sock_recvmsg+0x1a8/0x270 net/socket.c:1100 ____sys_recvmsg+0x1e6/0x4a0 net/socket.c:2812 ___sys_recvmsg+0x215/0x590 net/socket.c:2854 do_recvmmsg+0x334/0x800 net/socket.c:2949 __sys_recvmmsg net/socket.c:3023 [inline] __do_sys_recvmmsg net/socket.c:3046 [inline] __se_sys_recvmmsg net/socket.c:3039 [inline] __x64_sys_recvmmsg+0x198/0x250 net/socket.c:3039 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb319f9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb31ad97028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fb31a216090 RCX: 00007fb319f9aeb9 RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000004 RBP: 00007fb31a008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000040000021 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb31a216128 R14: 00007fb31a216090 R15: 00007ffe21dd0a98 </TASK>

Allocated by task 6019: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x3d1/0x6e0 mm/slub.c:5780 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] alloc_sk_msg net/core/skmsg.c:510 [inline] sk_psock_skb_ingress_self+0x60/0x350 net/core/skmsg.c:612 sk_psock_verdict_apply net/core/skmsg.c:1038 [inline] sk_psock_verdict_recv+0x7d9/0x8d0 net/core/skmsg.c:1236 udp_read_skb+0x73e/0x7e0 net/ipv4/udp.c:2045 sk_psock_verdict_data_ready+0x12d/0x550 net/core/skmsg.c:1257 __udp_enqueue_schedule_skb+0xc54/0x10b0 net/ipv4/udp.c:1789 __udp_queue_rcv_skb net/ipv4/udp.c:2346 [inline] udp_queue_rcv_one_skb+0xac5/0x19c0 net/ipv4/udp.c:2475 __udp4_lib_mcast_deliver+0xc06/0xcf0 net/ipv4/udp.c:2585 __udp4_lib_rcv+0x10f6/0x2620 net/ipv4/udp.c:2724 ip_protocol_deliver_rcu+0x282/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 dst_input include/net/dst.h:474 [inline] ip_sublist_rcv_finish+0x221/0x2a0 net/ipv4/ip_input.c:584 ip_list_rcv_finish net/ipv4/ip_inp ---truncated---

Executive ViewAI

Why It Matters

A memory corruption vulnerability in the Linux kernel's networking stack allows attackers with local system access to escalate privileges to root, exfiltrate kernel memory, or crash systems. This affects all organizations running Linux infrastructure where multiple users have local access, creating risk of insider threats and complete system compromise.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 94% exploitable
Prevalence
Ubiquitous
Linux kernel underlies virtually all cloud, server, and container environments globally
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-74257 ADVISORY https://ubuntu.com/security/notices/USN-8887-1 ADVISORY https://ubuntu.com/security/notices/USN-8888-1 ADVISORY https://ubuntu.com/security/notices/USN-8889-1 ADVISORY https://vuldb.com/vuln/390205 REF https://git.kernel.org/stable/c/05c29e7d42926170f0595c7188d60d8ecb665593 REF https://git.kernel.org/stable/c/39d44ed6904bfa9a1c6d0538672dd50c7b85520e REF https://git.kernel.org/stable/c/6b59007d95aeef6619a72f5ea51f58752c47c198 REF https://git.kernel.org/stable/c/6ea94949a5afe457647def276cd6958721481abd REF https://git.kernel.org/stable/c/81567d2b3f4dc4fc32f8b61433738bce2cafd4a1 REF https://git.kernel.org/stable/c/c010995b29c8939c6aa69e3cb26f8dbee163d156

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy