CVE-2026-74714

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto

the ehash chain, drops the bucket lock, and only afterwards sets

rsk_refcnt to 3.

Lockless readers such as __inet_lookup_established() handle this with

refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain

sock_hold() while holding the bucket lock, on the assumption that the

lock guarantees sk_refcnt > 0. That assumption does not hold for

request_sock:

CPU 0 CPU 1

----- -----

tcp_conn_request()

reqsk_queue_hash_req()

inet_ehash_insert(req)

spin_lock(bucket)

__sk_nulls_add_node_rcu(req) // rsk_refcnt == 0

spin_unlock(bucket)

bpf_iter_tcp_established_batch()

spin_lock(bucket)

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References