Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to a system crash or memory corruption. The issue occurs when the kernel's BPF (Berkeley Packet Filter) system and TLS (Transport Layer Security) acceleration features conflict while processing incoming data. This conflict can cause the system to attempt to use memory that has already been freed, potentially allowing a local attacker to disrupt system stability or operations.
Technical details
A use-after-free (UAF) vulnerability exists in net/core/skmsg.c within the Linux kernel. The root cause is a race condition in sk_psock_verdict_data_ready() when a socket is associated with a BPF sockmap (BPF_SK_SKB_VERDICT) before kTLS RX is configured. When data arrives, sk_psock_verdict_data_ready() may drain the receive queue without properly advancing the sequence counter, leading the TLS parser to reference a stale or freed socket buffer (skb). An attacker with local access could exploit this to trigger a kernel panic or potentially achieve arbitrary code execution. The fix introduces a guard to check for TLS RX context and defer to the saved data-ready handler, ensuring TLS retains proper ownership of the receive queue.
Affected products
- Linux Linux Kernel ef5659280eb1 to c9ea01768903ae47f210cd457af1dead6de7a9c3
Timeline
- 2026-05-17: other: Patch submitted by developer
- 2026-06-01: patched: Commits merged into stable branches
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b
- https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c
- https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71
- https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3
- https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab