GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-68399 (GCVE-0-2026-68399)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-17 05:04
VLAI
Title
bpf: Fix UAF in sock clone early bailouts
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk. If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket. Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d , < 14b49b5ab29979552c219a09e569b424fbbf4a6e (git)
Affected: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d , < 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.2
Unaffected: 0 , < 5.2 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/bpf_sk_storage.c",
            "net/core/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "14b49b5ab29979552c219a09e569b424fbbf4a6e",
              "status": "affected",
              "version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
              "versionType": "git"
            },
            {
              "lessThan": "7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f",
              "status": "affected",
              "version": "6ac99e8f23d4b10258406ca0dd7bffca5f31da9d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/bpf_sk_storage.c",
            "net/core/sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe -\u003ebpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field -\u003esk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk-\u003esk_bpf_storage still points\nto the parent socket\u0027s BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() -\u003e\nbpf_sk_storage_free()) destroys the parent socket\u0027s BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk-\u003esk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable clone path and its early-bailout condition are driven through the BPF sk_storage subsystem and local socket setup (attaching sk_storage, attaching a socket filter, adjusting optmem_max). Per kernel guidance BPF is Local; a remote peer cannot control the bailout conditions.\nAC:L - An attacker who controls the local setup can deterministically force the early bailout by attaching a filter and lowering net.core.optmem_max below the filter size, exactly the sysctl-change scenario the code documents, making sk_filter_charge fail on every clone.\nPR:L - Reaching the bug requires attaching BPF sk_storage and manipulating socket/net settings; these capabilities (CAP_BPF/CAP_NET_ADMIN) can be reachable via user namespaces in some configurations, so the lower-privilege value is chosen per the higher-severity rule.\nUI:N - The clone is triggered by connection acceptance or association creation with no victim action; no user interaction is needed.\nS:U - The UAF corrupts kernel socket/BPF-storage objects within the kernel\u0027s own security authority; no crossing into a separate security scope (no VM/IOMMU boundary).\nC:H - The use-after-free lets the attacker reclaim the freed bpf_local_storage object with controlled contents, enabling disclosure of kernel memory; per guidance UAF is High.\nI:H - UAF on a live socket\u0027s BPF storage enables heap grooming and arbitrary-write primitives, giving control-flow hijack potential; per guidance UAF is High.\nA:H - Destroying the parent socket\u0027s still-referenced BPF local storage reliably causes memory corruption, oops, and kernel panic; per guidance any UAF/crash is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:04:47.842Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e"
        },
        {
          "url": "https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f"
        }
      ],
      "title": "bpf: Fix UAF in sock clone early bailouts",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68399",
    "datePublished": "2026-08-10T12:04:18.837Z",
    "dateReserved": "2026-07-30T09:28:09.389Z",
    "dateUpdated": "2026-08-17T05:04:47.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68399",
      "date": "2026-09-17",
      "epss": "0.00129",
      "percentile": "0.02922"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68399\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:33.383\",\"lastModified\":\"2026-08-17T06:17:48.670\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix UAF in sock clone early bailouts\\n\\nSimilar to recent commit 9b51a6155d14 (\\\"bpf,fork: wipe -\u003ebpf_storage\\nbefore bailouts that access it\\\"), sk_clone() performs an initial\\nshallow copy of the socket field -\u003esk_bpf_storage via sock_copy()\\nfor the cloned socket newsk.\\n\\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\\nto calling bpf_sk_storage_clone(), newsk-\u003esk_bpf_storage still points\\nto the parent socket\u0027s BPF local storage. When newsk is subsequently\\nfreed via sk_free(), the deallocation path (__sk_destruct() -\u003e\\nbpf_sk_storage_free()) destroys the parent socket\u0027s BPF local storage,\\nleading to a use-after-free (UAF) on the parent socket.\\n\\nFix this by resetting newsk-\u003esk_bpf_storage to NULL immediately after\\nsock_copy() in sk_clone(), and remove the now redundant initialization\\nfrom bpf_sk_storage_clone().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/core/bpf_sk_storage.c\",\"net/core/sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6ac99e8f23d4b10258406ca0dd7bffca5f31da9d\",\"lessThan\":\"14b49b5ab29979552c219a09e569b424fbbf4a6e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6ac99e8f23d4b10258406ca0dd7bffca5f31da9d\",\"lessThan\":\"7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/core/bpf_sk_storage.c\",\"net/core/sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.2\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.2\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:27:15+00:00",
      "cve": "CVE-2026-68399",
      "id": "CVE-2026-68399",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "233",
      "product_status:known_not_affected": "44",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Fix UAF in sock clone early bailouts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68399.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T15:42:08Z",
      "cve": "CVE-2026-68399",
      "id": "CVE-2026-68399",
      "initial_release_date": "2026-08-13T16:22:22Z",
      "product_status:first_fixed": "65",
      "product_status:known_affected": "650",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68399",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68399.json",
      "version": "8"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.