Executive brief
The Linux kernel's BPF sockmap component contains a use-after-free vulnerability in how it manages network packet buffers (skbs) during socket communication. An attacker can trigger a race condition that causes the kernel to reference freed memory, potentially leading to system crashes or arbitrary code execution. This affects Linux systems using BPF for advanced socket operations.
Technical details
The vulnerability is a use-after-free (CWE-416) in the BPF sockmap ingress path. When an skb is enqueued into the ingress_msg queue for user-space recvmsg() consumption, the userspace can call consume_skb() to free it. However, the sk_psock_backlog workqueue still holds a reference and attempts to dequeue the same skb, resulting in a double-free or access to freed memory. The root cause is missing refcount increment (skb_get()) before passing the skb to sk_psock_queue_msg(). The attack vector is local and requires the ability to use BPF sockmap operations (typically requiring CAP_BPF or CAP_SYS_ADMIN). The fix adds skb_get() before enqueueing and corresponding kfree_skb() calls to properly manage refcounts. This race was introduced by recent locking changes that removed implicit socket locking.
Affected products
- Linux Linux kernel kernel versions using BPF sockmap (approximately 5.9 and later)
Timeline
- 2025-12-09: disclosed
- 2023: advisory: CVE-2023-53836