CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix cork use-after-free in tcpbpfsendmsg()

tcpbpfsendmsg() keeps msgtx across skstreamwaitmemory(), which drops and reacquires the socket lock. Its error path tries to decide whether msgtx names the local temporary message by comparing it with the current value of psock->cork.

This comparison is unsafe when two threads send on the same socket:

Thread A Thread B msgtx = psock->cork skmsgalloc() fails skstreamwaitmemory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msgtx != psock->cork skmsgfree(msgtx)

The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported:

BUG: KASAN: slab-use-after-free in skmsgfree+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: skmsgfree+0x49/0x50 tcpbpfsendmsg+0x14f5/0x1cc0 syssendto+0x32c/0x3a0 x64syssendto+0xdb/0x1b0 Allocated by task 89: kasankmalloc+0x8f/0xa0 tcpbpfsendmsg+0x16b3/0x1cc0 Freed by task 91: kasanslabfree+0x43/0x70 kfree+0x131/0x3c0 tcpbpfsendmsg+0xec3/0x1cc0

msgtx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one.