CVE-2026-52938

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths

bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before

removing the selem from the storage hlist. A concurrent RCU reader in

bpf_sk_storage_clone() can observe the selem still on the list with

smap already NULL, causing a NULL pointer dereference.

general protection fault, probably for non-canonical address 0xdffffc000000000a:

KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]

RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174

Call Trace:

<IRQ>

sk_clone+0xfed/0x1980 net/core/sock.c:2591

inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222

tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571

tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729

tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855

tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347

Ad

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References