CVE-2026-68399: bpf: Fix UAF in sock clone early bailouts
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in sock clone early bailouts
Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpfstorage before bailouts that access it"), skclone() performs an initial shallow copy of the socket field ->skbpfstorage via sockcopy() for the cloned socket newsk.
If skclone() bails out early (e.g. if skfiltercharge() fails) prior to calling bpfskstorageclone(), newsk->skbpfstorage still points to the parent socket's BPF local storage. When newsk is subsequently freed via skfree(), the deallocation path (skdestruct() -> bpfskstoragefree()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket.
Fix this by resetting newsk->skbpfstorage to NULL immediately after sockcopy() in skclone(), and remove the now redundant initialization from bpfskstorageclone().
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reset newsk->sk_bpf_storage to NULL immediately after the initial shallow copy via sock_copy() in sk_clone, so early bailouts that call bpf_sk_storage_clone()/bpf_sk_storage_free() do not leave newsk->sk_bpf_storage pointing to the parent socket's BPF local storage.
Linux kernel (BPF sock clone path / sk_clone) newsk->sk_bpf_storage = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68399?
CVE-2026-68399 has a risk rating of 47, indicating a potential security threat.
What type of vulnerability is CVE-2026-68399?
CVE-2026-68399 is classified as a Use After Free vulnerability.
How do I fix CVE-2026-68399?
To fix CVE-2026-68399, update to the latest version of the Linux kernel where the vulnerability has been resolved.
What component is affected by CVE-2026-68399?
CVE-2026-68399 affects the BPF (Berkeley Packet Filter) implementation in the Linux kernel.
When was CVE-2026-68399 published?
CVE-2026-68399 was published on August 10, 2026.