GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64575 (GCVE-0-2026-64575)

Vulnerability from cvelistv5 – Published: 2026-08-05 08:09 – Updated: 2026-08-19 16:28
VLAI
Title
bpf: tcp: fix double sock release on batch realloc
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers. bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr 0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9794ac757a650dd594391192183c9caf939f8223 , < c842882e4c5d2818b858d6baf3fd10958c93f729 (git)
Affected: 1d7a82c1df5fc397eaca9c6b8c8f61aae9866ad4 , < 7a6a6d2a127866935f87b55b557bc89693065462 (git)
Affected: 36f955807ee4ede07e9410772f792e4cb4ec807b , < f0c1810320b0dac228103fad7311e89532134d83 (git)
Affected: cdec67a489d4fdae3e83e04fca0419136a83c4c2 , < 9f27c4f0ae35b5390ce4f7a54d3501144e41a54d (git)
Affected: cdec67a489d4fdae3e83e04fca0419136a83c4c2 , < 8a726e9585ffe7bfbfad2b5279277a00973970f3 (git)
Affected: cdec67a489d4fdae3e83e04fca0419136a83c4c2 , < 980a813452754f8001704744e92f7aa697c53dd3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c842882e4c5d2818b858d6baf3fd10958c93f729",
              "status": "affected",
              "version": "9794ac757a650dd594391192183c9caf939f8223",
              "versionType": "git"
            },
            {
              "lessThan": "7a6a6d2a127866935f87b55b557bc89693065462",
              "status": "affected",
              "version": "1d7a82c1df5fc397eaca9c6b8c8f61aae9866ad4",
              "versionType": "git"
            },
            {
              "lessThan": "f0c1810320b0dac228103fad7311e89532134d83",
              "status": "affected",
              "version": "36f955807ee4ede07e9410772f792e4cb4ec807b",
              "versionType": "git"
            },
            {
              "lessThan": "9f27c4f0ae35b5390ce4f7a54d3501144e41a54d",
              "status": "affected",
              "version": "cdec67a489d4fdae3e83e04fca0419136a83c4c2",
              "versionType": "git"
            },
            {
              "lessThan": "8a726e9585ffe7bfbfad2b5279277a00973970f3",
              "status": "affected",
              "version": "cdec67a489d4fdae3e83e04fca0419136a83c4c2",
              "versionType": "git"
            },
            {
              "lessThan": "980a813452754f8001704744e92f7aa697c53dd3",
              "status": "affected",
              "version": "cdec67a489d4fdae3e83e04fca0419136a83c4c2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: fix double sock release on batch realloc\n\nbpf_iter_tcp_batch() releases the current batch via\nbpf_iter_tcp_put_batch(), which drops the socket refs and rewrites\neach slot with the socket cookie, then grows the batch. cur_sk/end_sk\nare kept for bpf_iter_tcp_resume(), but on realloc failure the function\nreturns ERR_PTR() before resume runs, leaving cur_sk \u003c end_sk over\nslots that now hold cookies rather than sock pointers.\nbpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and\ndereferences a cookie as a struct sock.\n\nEmpty the batch on the failure path so stop() does not release it\nagain. The sockets were already freed by the first\nbpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans\nthe bucket from the start instead of skipping it. The sibling\nGFP_NOWAIT failure path still holds real socket references and is left\nfor stop() to release.\n\n  BUG: KASAN: null-ptr-deref in __sock_gen_cookie\n  Read of size 8 at addr 0000000000000059 by task exploit\n   ...\n   __sock_gen_cookie (net/core/sock_diag.c:28)\n   bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918)\n   bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270)\n   bpf_seq_read (kernel/bpf/bpf_iter.c:205)\n   vfs_read (fs/read_write.c:572)\n   ksys_read (fs/read_write.c:716)\n   do_syscall_64\n   entry_SYSCALL_64_after_hwframe\n  Kernel panic - not syncing: Fatal exception"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Reached only through local bpf() syscalls that load a BPF_TRACE_ITER TCP program, create an iterator fd, and read it; bpf_seq_read drives bpf_iter_tcp_batch/stop. Per guidance BPF subsystem bugs are Local, not network-reachable.\nAC:L - The attacker controls both prerequisites: creating more than INIT_BATCH_SZ TCP sockets in one hash bucket to force bpf_iter_tcp_put_batch-then-realloc, and inducing GFP_USER -ENOMEM (memory pressure/cgroup limits) so the failure path runs without races outside their control.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON, which BPF tokens can delegate into a non-init user namespace; consistent with other BPF iterator CVEs this is Low rather than full init-namespace root.\nUI:N - The attacker loads their own TCP iterator program and triggers the bug by reading their iterator fd; no victim action such as mounting, opening a file, or interacting with the attacker is required.\nS:U - Impact is kernel memory corruption and panic within the same host kernel security authority; this is a standard local kernel bug, not a VM/hypervisor escape or IOMMU boundary bypass.\nC:H - stop() re-enters bpf_iter_tcp_put_batch and treats stored socket cookies as struct sock pointers, so sock_gen_cookie performs an out-of-bounds/wild kernel read; type-confused pointer dereference supports high confidentiality impact under the higher-severity rule.\nI:H - The same type confusion reaches sock_gen_put, which decrements sk_refcnt and may free through the forged pointer, yielding kernel memory corruption and a plausible control-flow/integrity primitive beyond a clean crash.\nA:H - The reported path is a KASAN null-ptr-deref in __sock_gen_cookie during bpf_iter_tcp_seq_stop that ends in kernel panic; the attacker can repeat the iterator read to deny host availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:54.764Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c842882e4c5d2818b858d6baf3fd10958c93f729"
        },
        {
          "url": "https://git.kernel.org/stable/c/7a6a6d2a127866935f87b55b557bc89693065462"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0c1810320b0dac228103fad7311e89532134d83"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f27c4f0ae35b5390ce4f7a54d3501144e41a54d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a726e9585ffe7bfbfad2b5279277a00973970f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/980a813452754f8001704744e92f7aa697c53dd3"
        }
      ],
      "title": "bpf: tcp: fix double sock release on batch realloc",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64575",
    "datePublished": "2026-08-05T08:09:31.923Z",
    "dateReserved": "2026-07-19T15:36:31.797Z",
    "dateUpdated": "2026-08-19T16:28:54.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64575",
      "date": "2026-09-20",
      "epss": "0.00121",
      "percentile": "0.0219"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp_ipv4.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c842882e4c5d2818b858d6baf3fd10958c93f729",
                    "status": "affected",
                    "version": "9794ac757a650dd594391192183c9caf939f8223",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7a6a6d2a127866935f87b55b557bc89693065462",
                    "status": "affected",
                    "version": "1d7a82c1df5fc397eaca9c6b8c8f61aae9866ad4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0c1810320b0dac228103fad7311e89532134d83",
                    "status": "affected",
                    "version": "36f955807ee4ede07e9410772f792e4cb4ec807b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9f27c4f0ae35b5390ce4f7a54d3501144e41a54d",
                    "status": "affected",
                    "version": "cdec67a489d4fdae3e83e04fca0419136a83c4c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a726e9585ffe7bfbfad2b5279277a00973970f3",
                    "status": "affected",
                    "version": "cdec67a489d4fdae3e83e04fca0419136a83c4c2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "980a813452754f8001704744e92f7aa697c53dd3",
                    "status": "affected",
                    "version": "cdec67a489d4fdae3e83e04fca0419136a83c4c2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp_ipv4.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: fix double sock release on batch realloc\n\nbpf_iter_tcp_batch() releases the current batch via\nbpf_iter_tcp_put_batch(), which drops the socket refs and rewrites\neach slot with the socket cookie, then grows the batch. cur_sk/end_sk\nare kept for bpf_iter_tcp_resume(), but on realloc failure the function\nreturns ERR_PTR() before resume runs, leaving cur_sk \u003c end_sk over\nslots that now hold cookies rather than sock pointers.\nbpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and\ndereferences a cookie as a struct sock.\n\nEmpty the batch on the failure path so stop() does not release it\nagain. The sockets were already freed by the first\nbpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans\nthe bucket from the start instead of skipping it. The sibling\nGFP_NOWAIT failure path still holds real socket references and is left\nfor stop() to release.\n\n  BUG: KASAN: null-ptr-deref in __sock_gen_cookie\n  Read of size 8 at addr 0000000000000059 by task exploit\n   ...\n   __sock_gen_cookie (net/core/sock_diag.c:28)\n   bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918)\n   bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270)\n   bpf_seq_read (kernel/bpf/bpf_iter.c:205)\n   vfs_read (fs/read_write.c:572)\n   ksys_read (fs/read_write.c:716)\n   do_syscall_64\n   entry_SYSCALL_64_after_hwframe\n  Kernel panic - not syncing: Fatal exception"
          }
        ],
        "id": "CVE-2026-64575",
        "lastModified": "2026-08-19T17:20:17.387",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-05T08:16:37.363",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7a6a6d2a127866935f87b55b557bc89693065462"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a726e9585ffe7bfbfad2b5279277a00973970f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/980a813452754f8001704744e92f7aa697c53dd3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9f27c4f0ae35b5390ce4f7a54d3501144e41a54d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c842882e4c5d2818b858d6baf3fd10958c93f729"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0c1810320b0dac228103fad7311e89532134d83"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-08T16:34:52+00:00",
      "cve": "CVE-2026-64575",
      "id": "CVE-2026-64575",
      "initial_release_date": "2026-08-05T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: tcp: fix double sock release on batch realloc",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64575.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-17T16:31:26Z",
      "cve": "CVE-2026-64575",
      "id": "CVE-2026-64575",
      "initial_release_date": "2026-08-06T01:06:21Z",
      "product_status:known_not_affected": "296",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64575",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64575.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.