{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64575","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T15:36:31.797Z","datePublished":"2026-08-05T08:09:31.923Z","dateUpdated":"2026-08-19T16:28:54.764Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:28:54.764Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: fix double sock release on batch realloc\n\nbpf_iter_tcp_batch() releases the current batch via\nbpf_iter_tcp_put_batch(), which drops the socket refs and rewrites\neach slot with the socket cookie, then grows the batch. cur_sk/end_sk\nare kept for bpf_iter_tcp_resume(), but on realloc failure the function\nreturns ERR_PTR() before resume runs, leaving cur_sk < end_sk over\nslots that now hold cookies rather than sock pointers.\nbpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and\ndereferences a cookie as a struct sock.\n\nEmpty the batch on the failure path so stop() does not release it\nagain. The sockets were already freed by the first\nbpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans\nthe bucket from the start instead of skipping it. The sibling\nGFP_NOWAIT failure path still holds real socket references and is left\nfor stop() to release.\n\n  BUG: KASAN: null-ptr-deref in __sock_gen_cookie\n  Read of size 8 at addr 0000000000000059 by task exploit\n   ...\n   __sock_gen_cookie (net/core/sock_diag.c:28)\n   bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918)\n   bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270)\n   bpf_seq_read (kernel/bpf/bpf_iter.c:205)\n   vfs_read (fs/read_write.c:572)\n   ksys_read (fs/read_write.c:716)\n   do_syscall_64\n   entry_SYSCALL_64_after_hwframe\n  Kernel panic - not syncing: Fatal exception"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - Reached only through local bpf() syscalls that load a BPF_TRACE_ITER TCP program, create an iterator fd, and read it; bpf_seq_read drives bpf_iter_tcp_batch/stop. Per guidance BPF subsystem bugs are Local, not network-reachable.\nAC:L - The attacker controls both prerequisites: creating more than INIT_BATCH_SZ TCP sockets in one hash bucket to force bpf_iter_tcp_put_batch-then-realloc, and inducing GFP_USER -ENOMEM (memory pressure/cgroup limits) so the failure path runs without races outside their control.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON, which BPF tokens can delegate into a non-init user namespace; consistent with other BPF iterator CVEs this is Low rather than full init-namespace root.\nUI:N - The attacker loads their own TCP iterator program and triggers the bug by reading their iterator fd; no victim action such as mounting, opening a file, or interacting with the attacker is required.\nS:U - Impact is kernel memory corruption and panic within the same host kernel security authority; this is a standard local kernel bug, not a VM/hypervisor escape or IOMMU boundary bypass.\nC:H - stop() re-enters bpf_iter_tcp_put_batch and treats stored socket cookies as struct sock pointers, so sock_gen_cookie performs an out-of-bounds/wild kernel read; type-confused pointer dereference supports high confidentiality impact under the higher-severity rule.\nI:H - The same type confusion reaches sock_gen_put, which decrements sk_refcnt and may free through the forged pointer, yielding kernel memory corruption and a plausible control-flow/integrity primitive beyond a clean crash.\nA:H - The reported path is a KASAN null-ptr-deref in __sock_gen_cookie during bpf_iter_tcp_seq_stop that ends in kernel panic; the attacker can repeat the iterator read to deny host availability."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ipv4.c"],"versions":[{"version":"9794ac757a650dd594391192183c9caf939f8223","lessThan":"c842882e4c5d2818b858d6baf3fd10958c93f729","status":"affected","versionType":"git"},{"version":"1d7a82c1df5fc397eaca9c6b8c8f61aae9866ad4","lessThan":"7a6a6d2a127866935f87b55b557bc89693065462","status":"affected","versionType":"git"},{"version":"36f955807ee4ede07e9410772f792e4cb4ec807b","lessThan":"f0c1810320b0dac228103fad7311e89532134d83","status":"affected","versionType":"git"},{"version":"cdec67a489d4fdae3e83e04fca0419136a83c4c2","lessThan":"9f27c4f0ae35b5390ce4f7a54d3501144e41a54d","status":"affected","versionType":"git"},{"version":"cdec67a489d4fdae3e83e04fca0419136a83c4c2","lessThan":"8a726e9585ffe7bfbfad2b5279277a00973970f3","status":"affected","versionType":"git"},{"version":"cdec67a489d4fdae3e83e04fca0419136a83c4c2","lessThan":"980a813452754f8001704744e92f7aa697c53dd3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ipv4.c"],"versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/c842882e4c5d2818b858d6baf3fd10958c93f729"},{"url":"https://git.kernel.org/stable/c/7a6a6d2a127866935f87b55b557bc89693065462"},{"url":"https://git.kernel.org/stable/c/f0c1810320b0dac228103fad7311e89532134d83"},{"url":"https://git.kernel.org/stable/c/9f27c4f0ae35b5390ce4f7a54d3501144e41a54d"},{"url":"https://git.kernel.org/stable/c/8a726e9585ffe7bfbfad2b5279277a00973970f3"},{"url":"https://git.kernel.org/stable/c/980a813452754f8001704744e92f7aa697c53dd3"}],"title":"bpf: tcp: fix double sock release on batch realloc","x_generator":{"engine":"bippy-1.2.0"}}}}