CVE-2026-68386bpf, sockmap: Reject unhashed UDP sockets on sockmap update
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false. Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak. unreferenced object 0xffff88810bc2eb40 (size 1984): comm "test_progs", pid 2451, jiffies 4295320596 hex dump (first 32 bytes): 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................ 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace (crc bdee079d): kmem_cache_alloc_noprof+0x557/0x660 sk_prot_alloc+0x69/0x240 sk_alloc+0x30/0x460 inet_create+0x2ce/0xf80 __sock_create+0x25b/0x5c0 __sys_socket+0x119/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0xa1/0x5f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Instead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions: 1. sock_map_sk_state_allowed() maintains a fall-through `return true`. 2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage"), the proto::unhash BPF handler is not reintroduced. Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign").
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0c48eefae712c2fd91480346a07a1a9cd0f9470b before 2271276ac5279d2d204be7739a1a28d4ef6cf608; from 0c48eefae712c2fd91480346a07a1a9cd0f9470b before 7ffe529e7127411806c8692fb1490f552c629dc2; from 0c48eefae712c2fd91480346a07a1a9cd0f9470b before 17b7ef6b86112a4e61cee1e9009a4b318e3225c5; from 0c48eefae712c2fd91480346a07a1a9cd0f9470b before 250474c69bc3fc48a5fc21d7c349f279caad947a; from 0c48eefae712c2fd91480346a07a1a9cd0f9470b before 8692655da369961128658cf8539334b6a960ecb0; from 0c48eefae712c2fd91480346a07a1a9cd0f9470b before 66efd3368ae10d05e08fbe6425b50fdec7186ac7 | CNA record |
References
- https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608
- https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2
- https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5
- https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a
- https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0
- https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.