CVE-2026-68386

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject unhashed UDP sockets on sockmap update

UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means

sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.

Because sockmap accepts unbound UDP sockets, a BPF program can increment a

socket's refcount via lookup. If the socket is subsequently bound, the

transition from unbound to bound causes bpf_sk_release() to skip the

decrement of the refcount, causing a memory leak.

unreferenced object 0xffff88810bc2eb40 (size 1984):

comm "test_progs", pid 2451, jiffies 4295320596

hex dump (first 32 bytes):

7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................

02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............

backtrace (crc bdee079d):

kmem_cache_alloc_noprof+0x557/0x660

sk_prot_alloc+0x69/0x240

sk_alloc+0x30/0x460

inet_create+0x2ce/0xf80

__sock_create+0x25b/0x5c0

__sys_socket

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References