CVE-2026-74589: bpf, sockmap: Fix sk_redir use-after-free in send verdict
bpf, sockmap: Fix skredir use-after-free in send verdict
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
Which systems are exposed in practice?
Exposure is limited to Linux kernel deployments using BPF sockmap send verdict processing with socket redirection. The race requires a cached verdict to remain active through apply_bytes while concurrent sendmsg activity occurs on the same source socket.
What does an attacker or triggering workload need to do?
The triggering condition involves two sendmsg operations on the same source socket. One operation retains only a raw local redirect-socket pointer after dropping the source socket lock, while another consumes the remaining apply_bytes, clears psock->sk_redir, and releases the final socket reference.
How might this appear during testing or incident investigation?
KASAN can report a slab use-after-free in tcp_bpf_sendmsg_redir. The reported call path includes tcp_bpf_sendmsg_redir, tcp_bpf_sendmsg, and the sendto system-call path.