GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64025 (GCVE-0-2026-64025)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
bpf, skmsg: fix verdict sk_data_ready racing with ktls rx
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg().
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ef5659280eb13e8ac31c296f58cfdfa1684ac06b , < c9ea01768903ae47f210cd457af1dead6de7a9c3 (git)
Affected: ef5659280eb13e8ac31c296f58cfdfa1684ac06b , < 7c8cf21bc4efb4af18d6096db3f8bd06d622251c (git)
Affected: ef5659280eb13e8ac31c296f58cfdfa1684ac06b , < 1861d369efd62d67796563bf3e01fc22e5626f8b (git)
Affected: ef5659280eb13e8ac31c296f58cfdfa1684ac06b , < 8a52139560f833c3975032e1f5762611e3a36d71 (git)
Affected: ef5659280eb13e8ac31c296f58cfdfa1684ac06b , < ddf8029623a1af20e984c040e89ff918158397ab (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 6.6.142 , ≤ 6.6.* (semver)
Unaffected: 6.12.92 , ≤ 6.12.* (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c9ea01768903ae47f210cd457af1dead6de7a9c3",
              "status": "affected",
              "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
              "versionType": "git"
            },
            {
              "lessThan": "7c8cf21bc4efb4af18d6096db3f8bd06d622251c",
              "status": "affected",
              "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
              "versionType": "git"
            },
            {
              "lessThan": "1861d369efd62d67796563bf3e01fc22e5626f8b",
              "status": "affected",
              "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
              "versionType": "git"
            },
            {
              "lessThan": "8a52139560f833c3975032e1f5762611e3a36d71",
              "status": "affected",
              "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
              "versionType": "git"
            },
            {
              "lessThan": "ddf8029623a1af20e984c040e89ff918158397ab",
              "status": "affected",
              "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/skmsg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.92",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.142",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.92",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock-\u003esaved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser\u0027s ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\n\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx-\u003esaved_data_ready.  On data arrival:\n\n  tls_data_ready -\u003e tls_strp_data_ready -\u003e tls_rx_msg_ready\n    -\u003e saved_data_ready() = sk_psock_verdict_data_ready()\n      -\u003e tcp_read_skb() drains sk_receive_queue via __skb_unlink()\n         without calling tcp_eat_skb(), so copied_seq is not advanced.\n\ntls_strp_msg_load() then finds tcp_inq() \u003e= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx-\u003estrp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\n\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock-\u003esaved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is triggered on the kTLS software RX path when a remote TLS peer sends TCP data; inbound network packets drive tls_data_ready through to sk_psock_verdict_data_ready and tls_decrypt_sg on internet-facing eBPF/kTLS proxy servers.\nAC:L - Once the sockmap-before-TLS-RX configuration exists, the bug fires deterministically on the first arriving TLS record; the attacker controls packet delivery and timing without needing to win an uncontrollable race.\nPR:N - A remote unauthenticated TLS client needs no privileges on the victim host to trigger the bug on a server already running BPF sockmap verdict with kTLS RX; local exploitation via user namespaces only raises the bar to CAP_NET_ADMIN/CAP_BPF (PR:L), not higher.\nUI:N - Exploitation requires only sending TLS traffic to a vulnerable socket; no victim user action such as opening files or mounting filesystems is needed.\nS:U - Impact is kernel heap corruption within the host kernel security boundary; it does not inherently cross VM, container, or IOMMU isolation boundaries without separate escalation.\nC:H - The bug is a use-after-free where tls_decrypt_sg() walks a dangling skb frag_list via skb_to_sgvec/skb_copy_bits, enabling arbitrary kernel memory read primitives from attacker-influenced freed heap objects.\nI:H - Heap UAF over sk_buff structures in the TLS decrypt path can be leveraged for arbitrary kernel memory writes and control-flow hijacking, not merely a bounded or transient corruption.\nA:H - The failure path hits WARN_ON_ONCE in tls_strp_load_anchor_with_queue and the UAF in tls_decrypt_sg can cause kernel oops, panic, or crash during softirq TLS receive processing."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:19.891Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c"
        },
        {
          "url": "https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab"
        }
      ],
      "title": "bpf, skmsg: fix verdict sk_data_ready racing with ktls rx",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64025",
    "datePublished": "2026-07-19T15:39:17.178Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:19.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64025",
      "date": "2026-09-19",
      "epss": "0.00444",
      "percentile": "0.38037"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/skmsg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c9ea01768903ae47f210cd457af1dead6de7a9c3",
                    "status": "affected",
                    "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7c8cf21bc4efb4af18d6096db3f8bd06d622251c",
                    "status": "affected",
                    "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1861d369efd62d67796563bf3e01fc22e5626f8b",
                    "status": "affected",
                    "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a52139560f833c3975032e1f5762611e3a36d71",
                    "status": "affected",
                    "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddf8029623a1af20e984c040e89ff918158397ab",
                    "status": "affected",
                    "version": "ef5659280eb13e8ac31c296f58cfdfa1684ac06b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/skmsg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.142",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.34",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, skmsg: fix verdict sk_data_ready racing with ktls rx\n\nsk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and\ndefers to psock-\u003esaved_data_ready when a TLS RX context is present,\navoiding a conflict with the TLS strparser\u0027s ownership of the receive\nqueue (commit e91de6afa81c, \"bpf: Fix running sk_skb program types\nwith ktls\").\n\nsk_psock_verdict_data_ready() has no equivalent guard.  When a socket\nis inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is\nconfigured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready\nas rx_ctx-\u003esaved_data_ready.  On data arrival:\n\n  tls_data_ready -\u003e tls_strp_data_ready -\u003e tls_rx_msg_ready\n    -\u003e saved_data_ready() = sk_psock_verdict_data_ready()\n      -\u003e tcp_read_skb() drains sk_receive_queue via __skb_unlink()\n         without calling tcp_eat_skb(), so copied_seq is not advanced.\n\ntls_strp_msg_load() then finds tcp_inq() \u003e= full_len (stale), calls\ntcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and\nreturns with rx_ctx-\u003estrp.anchor.frag_list pointing at a psock-owned\n(potentially freed) skb.  tls_decrypt_sg() subsequently walks that\nfrag_list: use-after-free.\n\nApply the same fix as sk_psock_strp_data_ready(): if a TLS RX context\nis present, call psock-\u003esaved_data_ready (sock_def_readable) to wake\nrecv() waiters and return immediately, leaving the receive queue\nuntouched.  TLS retains sole ownership of the queue and decrypts the\nrecord normally through tls_sw_recvmsg()."
          }
        ],
        "id": "CVE-2026-64025",
        "lastModified": "2026-07-30T14:59:47.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:42.527",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:45+00:00",
      "cve": "CVE-2026-64025",
      "id": "CVE-2026-64025",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "43",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64025.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-10T16:48:05Z",
      "cve": "CVE-2026-64025",
      "id": "CVE-2026-64025",
      "initial_release_date": "2026-07-21T13:01:16Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "459",
      "product_status:known_not_affected": "245",
      "product_status:recommended": "250",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64025",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64025.json",
      "version": "16"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.