Executive brief
A vulnerability was identified in the Linux kernel's BPF subsystem, which is used for high-performance networking and system monitoring. Under specific conditions involving network socket operations, the system may experience a crash or "kernel panic" due to a memory management error. This issue primarily impacts system availability, potentially leading to a denial-of-service for the affected server.
Technical details
A race condition exists in the Linux kernel's BPF local storage implementation. Specifically, bpf_selem_unlink_nofail() sets the 'smap' pointer to NULL before removing a storage element from the hlist. A concurrent RCU reader in bpf_sk_storage_clone() or bpf_sk_storage_diag_put_all() can access the element while it is still on the list but has a NULL 'smap' pointer, resulting in a NULL pointer dereference and a general protection fault. The vulnerability is triggered during socket cloning (e.g., during TCP connection establishment) or diagnostic queries. A fix has been released that adds necessary NULL checks before dereferencing the 'smap' pointer.
Affected products
- Linux Linux Kernel 7.0
Timeline
- 2026-04-21: other: Patch submitted by developer
- 2026-06-24: disclosed: CVE published by NVD
- 2026-06-24: patched: Fix committed to stable kernel tree