CVE-2026-74589

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, sockmap: Fix sk_redir use-after-free in send verdict<br /> <br /> sk_psock_msg_verdict() takes a socket reference for psock-&gt;sk_redir.<br /> tcp_bpf_send_verdict() copies that pointer while holding the source socket<br /> lock, but does not take a reference for the local copy before dropping the<br /> lock around tcp_bpf_sendmsg_redir().<br /> <br /> When apply_bytes keeps the cached verdict active, another sendmsg() on the<br /> same source socket can consume the remaining bytes and release the cached<br /> reference while the first thread still holds only the raw local pointer:<br /> <br /> CPU 0 CPU 1<br /> sk_redir = psock-&gt;sk_redir<br /> apply_bytes remains nonzero<br /> release_sock(sk)<br /> lock_sock(sk)<br /> apply_bytes reaches zero<br /> psock-&gt;sk_redir = NULL<br /> release_sock(sk)<br /> tcp_bpf_sendmsg_redir(sk_redir)<br /> sock_put(sk_redir)<br /> tcp_bpf_sendmsg_redir(sk_redir)<br /> <br /> The final sock_put() can free sk_redir before CPU 0 dereferences it.<br /> <br /> KASAN reported:<br /> <br /> BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020<br /> Read of size 8 at addr ffff888108537090 by task poc/87<br /> Call Trace:<br /> tcp_bpf_sendmsg_redir+0xf39/0x1020<br /> tcp_bpf_sendmsg+0x977/0x1a50<br /> __sys_sendto+0x32c/0x3a0<br /> __x64_sys_sendto+0xdb/0x1b0<br /> Allocated by task 85:<br /> sk_prot_alloc+0x56/0x210<br /> sk_clone+0x6f/0x14b0<br /> inet_csk_clone_lock+0x24/0x740<br /> tcp_create_openreq_child+0x25/0x2710<br /> tcp_v4_syn_recv_sock+0x10a/0xe00<br /> Freed by task 0:<br /> __kasan_slab_free+0x43/0x70<br /> slab_free_after_rcu_debug+0xa6/0x1e0<br /> rcu_core+0x50a/0x1850<br /> Last potentially related work creation:<br /> __sk_destruct+0x3da/0x540<br /> sk_psock_destroy+0x81e/0xab0<br /> process_one_work+0x63a/0x1070<br /> <br /> Take a temporary socket reference while the source socket lock still<br /> protects psock-&gt;sk_redir, and drop it after tcp_bpf_sendmsg_redir()<br /> returns. This keeps each unlocked use independent of cached-verdict<br /> ownership.