CVE-2026-68386

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, sockmap: Reject unhashed UDP sockets on sockmap update<br /> <br /> UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means<br /> sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.<br /> <br /> Because sockmap accepts unbound UDP sockets, a BPF program can increment a<br /> socket&amp;#39;s refcount via lookup. If the socket is subsequently bound, the<br /> transition from unbound to bound causes bpf_sk_release() to skip the<br /> decrement of the refcount, causing a memory leak.<br /> <br /> unreferenced object 0xffff88810bc2eb40 (size 1984):<br /> comm "test_progs", pid 2451, jiffies 4295320596<br /> hex dump (first 32 bytes):<br /> 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................<br /> 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............<br /> backtrace (crc bdee079d):<br /> kmem_cache_alloc_noprof+0x557/0x660<br /> sk_prot_alloc+0x69/0x240<br /> sk_alloc+0x30/0x460<br /> inet_create+0x2ce/0xf80<br /> __sock_create+0x25b/0x5c0<br /> __sys_socket+0x119/0x1d0<br /> __x64_sys_socket+0x72/0xd0<br /> do_syscall_64+0xa1/0x5f0<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> <br /> Instead of special-casing for refcounted sockets, reject unhashed UDP<br /> sockets during sockmap updates, as there is no benefit to supporting those.<br /> This effectively reverts the commit under Fixes, with two exceptions:<br /> <br /> 1. sock_map_sk_state_allowed() maintains a fall-through `return true`.<br /> 2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash<br /> handler for BPF sockmap usage"), the proto::unhash BPF handler is not<br /> reintroduced.<br /> <br /> Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject<br /> unhashed sockets in bpf_sk_assign").