CVE-2026-74589

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix sk_redir use-after-free in send verdict

sk_psock_msg_verdict() takes a socket reference for psock->sk_redir.

tcp_bpf_send_verdict() copies that pointer while holding the source socket

lock, but does not take a reference for the local copy before dropping the

lock around tcp_bpf_sendmsg_redir().

When apply_bytes keeps the cached verdict active, another sendmsg() on the

same source socket can consume the remaining bytes and release the cached

reference while the first thread still holds only the raw local pointer:

CPU 0 CPU 1

sk_redir = psock->sk_redir

apply_bytes remains nonzero

release_sock(sk)

lock_sock(sk)

apply_bytes reaches zero

psock->sk_redir = NULL

release_sock(sk)

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References