CVE-2026-74268: tcp: clear sock_ops cb flags before force-closing a child socket
In the Linux kernel, the following vulnerability has been resolved:
tcp: clear sockops cb flags before force-closing a child socket
A child socket inherits the listener's bpfsockopscbflags via skclonelock(). If its setup fails in tcpv4synrecvsock() / tcpv6synrecvsock(), the child is freed through putandexit, where inetcskprepareforcedclose() drops the socket lock and tcpdone() runs without it.
If BPFSOCKOPSSTATECBFLAG was inherited, tcpdone() -> tcpsetstate() calls tcpcallbpf(), which expects the lock and trips sockownedbyme():
WARNING: include/net/sock.h:1799 at tcpsetstate+0x433/0x550 RIP: 0010:tcpsetstate+0x433/0x550 include/net/sock.h:1799 Call Trace: <IRQ> tcpdone+0xba/0x250 net/ipv4/tcp.c:5095 tcpv4synrecvsock+0x850/0xa50 net/ipv4/tcpipv4.c:1787 tcpcheckreq+0xf30/0x1360 net/ipv4/tcpminisocks.c:926 tcpv4rcv+0x1047/0x1b50 net/ipv4/tcpipv4.c:2164 </IRQ>
The child is freed before it is ever established, so it should run no sockops callback. Clear its cb flags in inetcskpreparefordestroysock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->synrecvsock() failure path (disposechild), which reaches tcpdone() on a child that was never established too.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74268?
CVE-2026-74268 has a risk rating of 27.
How do I fix CVE-2026-74268?
To fix CVE-2026-74268, update your Linux kernel to the version that includes the patch addressing this vulnerability.
What systems are affected by CVE-2026-74268?
CVE-2026-74268 affects the Linux kernel prior to the patched versions released following August 15, 2026.
What type of vulnerability is CVE-2026-74268?
CVE-2026-74268 is a vulnerability related to improper handling of socket options in the TCP protocol implementation.
Is CVE-2026-74268 exploitative?
CVE-2026-74268 could potentially be exploited if an attacker can trigger socket setup failures in a vulnerable system.