CVE-2026-68399

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF in sock clone early bailouts

Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage

before bailouts that access it"), sk_clone() performs an initial

shallow copy of the socket field ->sk_bpf_storage via sock_copy()

for the cloned socket newsk.

If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior

to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points

to the parent socket's BPF local storage. When newsk is subsequently

freed via sk_free(), the deallocation path (__sk_destruct() ->

bpf_sk_storage_free()) destroys the parent socket's BPF local storage,

leading to a use-after-free (UAF) on the parent socket.

Fix this by resetting newsk->sk_bpf_storage to NULL immediately after

sock_copy() in sk_clone(), and remove the now redundant initialization

from bpf_sk_storage_clone().

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References