UBUNTU-CVE-2026-98925: Medium severity ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket (self-redirect with BPFFINGRESS), skpsockverdictapply() calls tcpeatskb() which advances tcpsk->copiedseq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcpbpfrecvmsgparser(), which also advances copiedseq via the copiedfromself accounting path. This double-counting causes copiedseq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \ rcvnxt BF2E806, fl 0 WARNING: net/ipv4/tcp.c:2745 at tcprecvmsglocked+0x72b/0x2640 Call Trace: tcprecvmsg+0x10a/0x500 sockrecvmsg+0x168/0x1d0 sysrecvfrom+0x19a/0x2a0 x64sysrecvfrom+0xe4/0x1f0 dosyscall64+0xf7/0x530 entrySYSCALL64afterhwframe+0x77/0x7f cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806 WARNING: net/ipv4/tcp.c:1609 at tcpcleanuprbuf+0xf2/0x1c0 Call Trace: tcprecvmsglocked+0x8d1/0x2640 tcprecvmsg+0x10a/0x500 sockrecvmsg+0x168/0x1d0 sysrecvfrom+0x19a/0x2a0 x64sysrecvfrom+0xe4/0x1f0 dosyscall64+0xf7/0x530 entrySYSCALL64afterhwframe+0x77/0x7f Fix this by converting self-redirect verdict to SKPASS at the beginning of skpsockverdictapply(). This bypasses the SKREDIRECT case entirely (which calls skpsockeatskb), letting the SKPASS path queue the skb to the psock ingress queue. The data is then read via tcpbpfrecvmsgparser(), which advances copiedseq exactly once through copiedfromself. Cross-socket redirects continue through SKREDIRECT with skpsockeatskb() unchanged.