UBUNTU-CVE-2026-64575: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch() releases the current batch via bpfitertcpputbatch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk are kept for bpfitertcpresume(), but on realloc failure the function returns ERRPTR() before resume runs, leaving cursk < endsk over slots that now hold cookies rather than sock pointers. bpfitertcpseqstop() then calls bpfitertcpputbatch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpfitertcpputbatch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFPNOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in sockgencookie Read of size 8 at addr 0000000000000059 by task exploit ... sockgencookie (net/core/sockdiag.c:28) bpfitertcpputbatch (net/ipv4/tcpipv4.c:2918) bpfitertcpseqstop (net/ipv4/tcpipv4.c:3270) bpfseqread (kernel/bpf/bpfiter.c:205) vfsread (fs/readwrite.c:572) ksysread (fs/readwrite.c:716) dosyscall64 entrySYSCALL64afterhwframe Kernel panic - not syncing: Fatal exception
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In bpf_iter_tcp_batch(), empty or invalidate the batch on the realloc failure path after bpf_iter_tcp_put_batch() runs, so bpf_iter_tcp_seq_stop() does not release the batch again or treat cookie values as struct sock pointers.
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The vulnerability has local attack vector and low privileges required. No user interaction is required.
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What is the likely impact if exploitation succeeds?
The issue can cause a null-pointer dereference when TCP BPF iterator batch reallocation fails and cleanup treats socket cookies as socket pointers. The provided severity vector rates confidentiality, integrity, and availability impacts as high.
Is this limited to a normal TCP iterator path?
The fault occurs on the batch reallocation failure path in bpf_iter_tcp_batch(), before the iterator resume path runs. The separate GFP_NOWAIT failure path is described as retaining real socket references and is handled by the normal stop cleanup.