CVE-2026-68284

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which

drops and reacquires the socket lock. Its error path tries to decide

whether msg_tx names the local temporary message by comparing it with

the current value of psock->cork.

This comparison is unsafe when two threads send on the same socket:

Thread A Thread B

msg_tx = psock->cork

sk_msg_alloc() fails

sk_stream_wait_memory()

releases the socket lock acquires the socket lock

completes the cork

psock->cork = NULL

frees the cork

reacquires the socket lock

msg_tx != psock->cork

sk_msg_free(msg_tx)

The stale cork is therefore mistaken for the local temporary message

and freed again. KASAN reported:

BUG: KASAN: slab-use-after-free in sk_msg_fr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References