EUVD-2026-59415
GHSA-37cp-x28m-gm7h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Requires privileged eBPF sock_ops attachment (PR:H) and a setup-failure race (AC:H); impact observed is a lock-assertion warning affecting stability only (A:L, no C/I).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tcp: clear sock_ops cb flags before force-closing a child socket
A child socket inherits the listener's bpf_sock_ops_cb_flags via sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() / tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs without it.
If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state() calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me():
WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550 RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799 Call Trace: <IRQ> tcp_done+0xba/0x250 net/ipv4/tcp.c:5095 tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787 tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926 tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164 </IRQ>
The child is freed before it is ever established, so it should run no sock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done() on a child that was never established too.
AnalysisAI
Local denial-of-service / kernel-warning condition in the Linux kernel TCP stack allows a race during failed connection setup to trip a socket-lock assertion when eBPF sock_ops callbacks are in use. When a listener has a BPF sock_ops program with BPF_SOCK_OPS_STATE_CB_FLAG attached, a child socket that fails setup in tcp_v4/v6_syn_recv_sock() is force-closed without its socket lock held, causing tcp_done() -> tcp_set_state() -> tcp_call_bpf() to fire sock_owned_by_me() and emit a WARNING. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Triggering requires that the listening socket have an eBPF sock_ops program attached with the BPF_SOCK_OPS_STATE_CB_FLAG callback flag set (inherited by the child via sk_clone_lock), AND that a child socket fail setup in tcp_v4_syn_recv_sock()/tcp_v6_syn_recv_sock() (or the MPTCP dispose_child / chtls forced-close path), reaching inet_csk_prepare_forced_close() -> tcp_done() with the socket lock already dropped. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) is almost certainly the automated maximal score the kernel CNA process assigns and does not reflect the real bug, which manifests as a WARNING splat / assertion (WARN) rather than demonstrated code execution or information disclosure. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a host running an eBPF sock_ops program that enables BPF_SOCK_OPS_STATE_CB_FLAG on a listening socket (e.g. a service-mesh sidecar or L4 load balancer), an attacker or ordinary network conditions drive many inbound connections such that a child socket fails setup in the syn_recv path, hitting the force-close race and firing the kernel WARNING. … |
| Remediation | Vendor-released patch: update to a fixed Linux kernel build - 6.18.40, 7.1.5, or 7.2-rc1 (or your distribution's backport containing the corresponding stable commit ce311bd2e365, 8874dafc9099, or 990348e5bb45 from git.kernel.org/stable). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, apply the vendor-released patch to non-production systems and document all servers using eBPF sock_ops callbacks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today