CVE-2026-74257: sockmap: Fix use-after-free in udp_bpf_recvmsg()

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

sockmap: Fix use-after-free in udpbpfrecvmsg()

syzbot reported use-after-free of struct skmsg in skmsgrecvmsg(). [0]

skmsgrecvmsg() peeks skmsg from psock->ingressmsg under a lock, but its processing is lockless.

Thus, skmsgrecvmsg() must be serialised by callers, otherwise multiple threads could touch the same skmsg.

For example, TCP uses locksock(), and AFUNIX uses unixsk(sk)->iolock.

Initially, udpbpfrecvmsg() had used locksock(), but the cited commit removed it.

Let's serialise skmsgrecvmsg() with locksock() in udpbpfrecvmsg().

Note that holding spinlockbh(&sk->skreceivequeue.lock) is not an option due to copypagetoiter() in skmsgrecvmsg().

[0]: BUG: KASAN: slab-use-after-free in skmsgrecvmsg+0xb54/0xc30 net/core/skmsg.c:428 Read of size 4 at addr ffff88814cdcf000 by task syz.0.24/6020

CPU: 1 UID: 0 PID: 6020 Comm: syz.0.24 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Call Trace: <TASK> dumpstacklvl+0xe8/0x150 lib/dumpstack.c:120 printaddressdescription mm/kasan/report.c:378 [inline] printreport+0xba/0x230 mm/kasan/report.c:482 kasanreport+0x117/0x150 mm/kasan/report.c:595 skmsgrecvmsg+0xb54/0xc30 net/core/skmsg.c:428 udpbpfrecvmsg+0x4bd/0xe00 net/ipv4/udpbpf.c:84 inetrecvmsg+0x260/0x270 net/ipv4/afinet.c:891 sockrecvmsgnosec net/socket.c:1078 [inline] sockrecvmsg+0x1a8/0x270 net/socket.c:1100 sysrecvmsg+0x1e6/0x4a0 net/socket.c:2812 sysrecvmsg+0x215/0x590 net/socket.c:2854 dorecvmmsg+0x334/0x800 net/socket.c:2949 sysrecvmmsg net/socket.c:3023 [inline] dosysrecvmmsg net/socket.c:3046 [inline] sesysrecvmmsg net/socket.c:3039 [inline] x64sysrecvmmsg+0x198/0x250 net/socket.c:3039 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0xe2/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x77/0x7f RIP: 0033:0x7fb319f9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb31ad97028 EFLAGS: 00000246 ORIGRAX: 000000000000012b RAX: ffffffffffffffda RBX: 00007fb31a216090 RCX: 00007fb319f9aeb9 RDX: 0000000000000001 RSI: 0000200000000400 RDI: 0000000000000004 RBP: 00007fb31a008c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000040000021 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb31a216128 R14: 00007fb31a216090 R15: 00007ffe21dd0a98 </TASK>

Allocated by task 6019: kasansavestack mm/kasan/common.c:57 [inline] kasansavetrack+0x3e/0x80 mm/kasan/common.c:78 poisonkmallocredzone mm/kasan/common.c:398 [inline] kasankmalloc+0x93/0xb0 mm/kasan/common.c:415 kasankmalloc include/linux/kasan.h:263 [inline] kmalloccachenoprof+0x3d1/0x6e0 mm/slub.c:5780 kmallocnoprof include/linux/slab.h:957 [inline] kzallocnoprof include/linux/slab.h:1094 [inline] allocskmsg net/core/skmsg.c:510 [inline] skpsockskbingressself+0x60/0x350 net/core/skmsg.c:612 skpsockverdictapply net/core/skmsg.c:1038 [inline] skpsockverdictrecv+0x7d9/0x8d0 net/core/skmsg.c:1236 udpreadskb+0x73e/0x7e0 net/ipv4/udp.c:2045 skpsockverdictdataready+0x12d/0x550 net/core/skmsg.c:1257 udpenqueuescheduleskb+0xc54/0x10b0 net/ipv4/udp.c:1789 udpqueuercvskb net/ipv4/udp.c:2346 [inline] udpqueuercvoneskb+0xac5/0x19c0 net/ipv4/udp.c:2475 udp4libmcastdeliver+0xc06/0xcf0 net/ipv4/udp.c:2585 udp4librcv+0x10f6/0x2620 net/ipv4/udp.c:2724 ipprotocoldeliverrcu+0x282/0x440 net/ipv4/ipinput.c:207 iplocaldeliverfinish+0x3bb/0x6f0 net/ipv4/ipinput.c:241 NFHOOK+0x336/0x3c0 include/linux/netfilter.h:318 dstinput include/net/dst.h:474 [inline] ipsublistrcvfinish+0x221/0x2a0 net/ipv4/ipinput.c:584 iplistrcvfinish net/ipv4/ipinp ---truncated---

Affected Software

1 affected component
Linux Kernel

Event History

Aug 15, 2026
CVE Published
via MITRE·05:57 AM
Data Sourced
via MITRE·05:57 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203