CVE-2026-22977

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: sock: fix hardened usercopy panic in sock_recv_errqueue

skbuff_fclone_cache was created without defining a usercopy region,

[1] unlike skbuff_head_cache which properly whitelists the cb[] field.

[2] This causes a usercopy BUG() when CONFIG_HARDENED_USERCOPY is

enabled and the kernel attempts to copy sk_buff.cb data to userspace

via sock_recv_errqueue() -> put_cmsg().

The crash occurs when: 1. TCP allocates an skb using alloc_skb_fclone()

(from skbuff_fclone_cache) [1]

2. The skb is cloned via skb_clone() using the pre-allocated fclone

[3] 3. The cloned skb is queued to sk_error_queue for timestamp

reporting 4. Userspace reads the error queue via recvmsg(MSG_ERRQUEUE)

5. sock_recv_errqueue() calls put_cmsg() to copy serr->ee from skb->cb

[4] 6. __check_heap_object() fails because skbuff_fclone_cache has no

usercopy whitelist [5]

When cloned skbs allocated from skbuff_fclone_cache are used in the

socket er

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References