CVE-2026-74714 (GCVE-0-2026-74714)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-25 05:41
VLAI
Title
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3. Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt > 0. That assumption does not hold for request_sock: CPU 0 CPU 1 ----- ----- tcp_conn_request() reqsk_queue_hash_req() inet_ehash_insert(req) spin_lock(bucket) __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0 spin_unlock(bucket) bpf_iter_tcp_established_batch() spin_lock(bucket) sock_hold(req) <-- addition on 0 spin_unlock(bucket) refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value which surfaces as: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1 Call Trace: bpf_iter_tcp_established_batch+0x14e/0x170 bpf_iter_tcp_batch+0x53/0x200 bpf_iter_tcp_seq_next+0x27/0x70 bpf_seq_read+0x107/0x410 vfs_read+0xb9/0x380 The iterator's stolen reference is lost when the publishing CPU's refcount_set() overwrites the count, leaving the socket one reference short. When the last legitimate owner drops its reference the reqsk is freed while still reachable, leading to use-after-free. This reproduces in seconds with tcp_syncookies=0, a handful of threads doing connect()/close() to a local listener while others read an iter/tcp link in a tight loop. Use refcount_inc_not_zero() and skip the socket on failure. A skipped socket is still part of the bucket, so keep counting it in expected. The reallocations are sized from expected, and a request sock whose refcount gets published while the lock is held across the last realloc must already have room. A skipped socket is counted in expected but never batched, so end_sk can be short of expected on a batch that is actually complete. Decide completeness by whether the walk left any socket behind instead. The WARN after the locked realloc checks the same, replacing an end_sk == expected check that could not hold on that path since commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"). If every matching socket in a bucket is mid-init (refcount 0), end_sk stays 0. Advance to the next bucket rather than returning a batch entry that was never filled this round.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6667 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < cc0295f89296ed351fc4b0b48fee887ba02c5d24 (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < ddbe966b5d1fe212ada749bc3d0b410f1a7dea74 (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 7d2b60a4bc0499f62ff8520af6309bbe170882fd (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < cefcbbe20846a45f9a7dae868f7ef1000953e2df (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 97e74d3e45d653c07c2d406fc530a9bbe3df8396 (git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < e5fd3f514e27db1f05fbd72ba615d74941e23c51 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            },
            {
              "lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51",
              "status": "affected",
              "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\nrequest_sock:\n\n  CPU 0                                CPU 1\n  -----                                -----\n  tcp_conn_request()\n   reqsk_queue_hash_req()\n    inet_ehash_insert(req)\n     spin_lock(bucket)\n     __sk_nulls_add_node_rcu(req)      // rsk_refcnt == 0\n     spin_unlock(bucket)\n                                       bpf_iter_tcp_established_batch()\n                                        spin_lock(bucket)\n                                        sock_hold(req)   \u003c-- addition on 0\n                                        spin_unlock(bucket)\n    refcount_set(\u0026req-\u003ersk_refcnt, 3)  // clobbers saturated value\n\nwhich surfaces as:\n\n  refcount_t: addition on 0; use-after-free.\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n  Call Trace:\n   bpf_iter_tcp_established_batch+0x14e/0x170\n   bpf_iter_tcp_batch+0x53/0x200\n   bpf_iter_tcp_seq_next+0x27/0x70\n   bpf_seq_read+0x107/0x410\n   vfs_read+0xb9/0x380\n\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter-\u003ebatch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - bpf_iter_tcp_established_batch() is reached only via local bpf() to load a BPF_TRACE_ITER TCP program, create an iterator link/fd, and read() it (bpf_seq_read-\u003ebpf_iter_tcp_batch); per kernel CNA guidance BPF iterator paths are Local even though concurrent TCP_NEW_SYN_RECV creation can be driven by network SYNs.\nAC:L - The fix commit reproduces in seconds with threads doing connect()/close() while others read iter/tcp in a tight loop; the attacker controls both the BPF iterator and TCP connection churn, so the refcount race between sock_hold() and refcount_set() is reliably winnable without uncontrollable victim state.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON at bpf_prog_load(); per kernel CNA guidance these are Low privileges because BPF tokens and user namespaces can delegate them to non-init-namespace users, not only real root.\nUI:N - No victim interaction is required; the attacker loads their own iter/tcp BPF program and link, then triggers the race with self-generated connect/close traffic or SYN activity to listeners in the iterated network namespace.\nS:U - Impact is a kernel heap use-after-free and memory corruption within the same host kernel security authority; this is standard local kernel compromise/crash, not a VM escape, sandbox boundary cross, or IOMMU bypass.\nC:H - The iterator retains dangling request_sock pointers after refcount_set() clobbers a sock_hold() taken on sk_refcnt==0; subsequent bpf_iter_tcp_seq_show/put_batch dereference freed kernel objects, giving UAF read primitives per kernel CNA UAF guidance.\nI:H - Freed request_sock slabs can be reallocated while the iterator batch still references them; UAF enables corrupted socket metadata, refcount abuse, and control-flow hijacking via heap grooming, meeting High integrity under kernel CNA memory-corruption guidance.\nA:H - The bug surfaces as refcount_warn_saturate and leaves the reqsk one reference short so it is freed while still reachable from the iterator batch, causing kernel oops/panic; the tight-loop repro shows reliable, repeatable host denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:57.341Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"
        },
        {
          "url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"
        },
        {
          "url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"
        },
        {
          "url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"
        }
      ],
      "title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74714",
    "datePublished": "2026-08-22T15:33:09.643Z",
    "dateReserved": "2026-08-15T05:44:03.928Z",
    "dateUpdated": "2026-08-25T05:41:57.341Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74714",
      "date": "2026-10-15",
      "epss": "0.00126",
      "percentile": "0.02029"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-25T01:46:47.000Z",
      "cve": "CVE-2026-74714",
      "id": "msrc_CVE-2026-74714",
      "initial_release_date": "2026-08-24T01:02:12.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74714.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp_ipv4.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24",
                    "status": "affected",
                    "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74",
                    "status": "affected",
                    "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd",
                    "status": "affected",
                    "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df",
                    "status": "affected",
                    "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396",
                    "status": "affected",
                    "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51",
                    "status": "affected",
                    "version": "04c7820b776f1c4b48698574c47de9e940d368e8",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp_ipv4.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.152",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.104",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.45",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\nrequest_sock:\n\n  CPU 0                                CPU 1\n  -----                                -----\n  tcp_conn_request()\n   reqsk_queue_hash_req()\n    inet_ehash_insert(req)\n     spin_lock(bucket)\n     __sk_nulls_add_node_rcu(req)      // rsk_refcnt == 0\n     spin_unlock(bucket)\n                                       bpf_iter_tcp_established_batch()\n                                        spin_lock(bucket)\n                                        sock_hold(req)   \u003c-- addition on 0\n                                        spin_unlock(bucket)\n    refcount_set(\u0026req-\u003ersk_refcnt, 3)  // clobbers saturated value\n\nwhich surfaces as:\n\n  refcount_t: addition on 0; use-after-free.\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n  Call Trace:\n   bpf_iter_tcp_established_batch+0x14e/0x170\n   bpf_iter_tcp_batch+0x53/0x200\n   bpf_iter_tcp_seq_next+0x27/0x70\n   bpf_seq_read+0x107/0x410\n   vfs_read+0xb9/0x380\n\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter-\u003ebatch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: tcp: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n en bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publica un request_sock TCP_NEW_SYN_RECV en la cadena ehash, libera el bloqueo del bucket, y solo despu\u00e9s establece rsk_refcnt en 3.\n\nLectores sin bloqueo como __inet_lookup_established() manejan esto con refcount_inc_not_zero(), pero bpf_iter_tcp_established_batch() usa un sock_hold() simple mientras mantiene el bloqueo del bucket, bajo la suposici\u00f3n de que el bloqueo garantiza sk_refcnt \u003e 0. Esa suposici\u00f3n no se cumple para request_sock:\n\n  CPU 0                                CPU 1\n  -----                                -----\n  tcp_conn_request()\n   reqsk_queue_hash_req()\n    inet_ehash_insert(req)\n     spin_lock(bucket)\n     __sk_nulls_add_node_rcu(req)      // rsk_refcnt == 0\n     spin_unlock(bucket)\n                                       bpf_iter_tcp_established_batch()\n                                        spin_lock(bucket)\n                                        sock_hold(req)    \u003c- - adici\u00f3n en 0\n                                        spin_unlock(bucket)\n    refcount_set(\u0026req -\u003e rsk_refcnt, 3)  // sobrescribe el valor saturado\n\nlo que se manifiesta como:\n\n  refcount_t: adici\u00f3n en 0; uso despu\u00e9s de liberaci\u00f3n.\n  ADVERTENCIA: lib/refcount.c:25 en refcount_warn_saturate+0x48/0x90, CPU#1\n  Ruta de Llamada:\n   bpf_iter_tcp_established_batch+0x14e/0x170\n   bpf_iter_tcp_batch+0x53/0x200\n   bpf_iter_tcp_seq_next+0x27/0x70\n   bpf_seq_read+0x107/0x410\n   vfs_read+0xb9/0x380\n\nLa referencia robada del iterador se pierde cuando el refcount_set() de la CPU publicadora sobrescribe el contador, dejando al socket con una referencia menos. Cuando el \u00faltimo propietario leg\u00edtimo libera su referencia, el reqsk es liberado mientras a\u00fan es accesible, lo que lleva a un uso despu\u00e9s de liberaci\u00f3n.\n\nEsto se reproduce en segundos con tcp_syncookies=0, un pu\u00f1ado de hilos realizando connect()/close() a un oyente local mientras otros leen un enlace iter/tcp en un bucle cerrado.\n\nUse refcount_inc_not_zero() y omita el socket en caso de fallo. Un socket omitido sigue siendo parte del bucket, as\u00ed que siga cont\u00e1ndolo en \u0027expected\u0027. Las reasignaciones se dimensionan a partir de \u0027expected\u0027, y un request sock cuyo refcount se publica mientras el bloqueo se mantiene durante la \u00faltima reasignaci\u00f3n ya debe tener espacio.\n\nUn socket omitido se cuenta en \u0027expected\u0027 pero nunca se procesa en lotes, por lo que end_sk puede ser menor que \u0027expected\u0027 en un lote que en realidad est\u00e1 completo. Decida la completitud seg\u00fan si el recorrido dej\u00f3 alg\u00fan socket atr\u00e1s en su lugar. La ADVERTENCIA despu\u00e9s de la reasignaci\u00f3n bloqueada verifica lo mismo, reemplazando una verificaci\u00f3n de end_sk == expected que no pod\u00eda mantenerse en esa ruta desde el commit cdec67a489d4 (\u0027bpf: tcp: Aseg\u00farese de que iter -\u003e batch siempre contenga una instant\u00e1nea completa del bucket\u0027).\n\nSi cada socket coincidente en un bucket est\u00e1 en medio de la inicializaci\u00f3n (refcount 0), end_sk permanece en 0. Avance al siguiente bucket en lugar de devolver una entrada de lote que nunca se llen\u00f3 en esta ronda."
          }
        ],
        "id": "CVE-2026-74714",
        "lastModified": "2026-10-14T13:10:00.187",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-22T16:16:46.170",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:55:47+00:00",
      "cve": "CVE-2026-74714",
      "id": "CVE-2026-74714",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74714.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.