CVE-2026-64575

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: tcp: fix double sock release on batch realloc

bpf_iter_tcp_batch() releases the current batch via

bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites

each slot with the socket cookie, then grows the batch. cur_sk/end_sk

are kept for bpf_iter_tcp_resume(), but on realloc failure the function

returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over

slots that now hold cookies rather than sock pointers.

bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and

dereferences a cookie as a struct sock.

Empty the batch on the failure path so stop() does not release it

again. The sockets were already freed by the first

bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans

the bucket from the start instead of skipping it. The sibling

GFP_NOWAIT failure path still holds real socket references and is left

for stop() to release.

BUG: KASAN: null-ptr-deref in __sock_g

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References