Executive brief
The Linux kernel's BPF socket mapping feature has a reference counting bug in its TCP message redirector that causes the same socket object to be released multiple times when processing fragmented messages. This leads to memory corruption and kernel crashes, potentially allowing a local attacker to trigger a denial of service or exploit the memory corruption for further privilege escalation.
Technical details
The vulnerability exists in the tcp_bpf_send_verdict() function in net/ipv4/tcp_bpf.c. When handling TCP message redirection with the BPF sockmap feature, the eval variable is set to __SK_REDIRECT after sending apply_bytes data. If a message has the more_data flag set (indicating fragmentation), the function loops back to the more_data label but does not reset eval to __SK_NONE, causing sock_put() to be called repeatedly on the same socket reference. This leads to a use-after-free condition in the socket reference counting, as seen in the kernel warning "refcount_t: addition on 0; use-after-free." The fix resets eval to __SK_NONE at the start of each more_data iteration. Attack requires CAP_NET_ADMIN to load and run BPF programs, or via unprivileged BPF if enabled. The patch is available in upstream commit 7a9841ca025275b5b0edfb0b618934abb6ceec15.
Affected products
- Linux Linux kernel multiple versions (present in at least 5.x and 6.0 branches)
Timeline
- 2022-11-29: disclosed: Vulnerability reported by Pengcheng Yang
- 2022-12-31: patched: Fix merged into Linux 6.0.y stable branch (commit 113236e8f49f262f318c00ebb14b15f4834e87c1)
- 2023-01-14: patched: Fix merged into additional stable branches
- 2025-10-07: advisory: CVE-2022-50536 published