CVE-2026-74714 (GCVE-0-2026-74714)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:33 – Updated: 2026-08-22 15:33
VLAI
EPSS
VEX
Title
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto
the ehash chain, drops the bucket lock, and only afterwards sets
rsk_refcnt to 3.
Lockless readers such as __inet_lookup_established() handle this with
refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain
sock_hold() while holding the bucket lock, on the assumption that the
lock guarantees sk_refcnt > 0. That assumption does not hold for
request_sock:
CPU 0 CPU 1
----- -----
tcp_conn_request()
reqsk_queue_hash_req()
inet_ehash_insert(req)
spin_lock(bucket)
__sk_nulls_add_node_rcu(req) // rsk_refcnt == 0
spin_unlock(bucket)
bpf_iter_tcp_established_batch()
spin_lock(bucket)
sock_hold(req) <-- addition on 0
spin_unlock(bucket)
refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value
which surfaces as:
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1
Call Trace:
bpf_iter_tcp_established_batch+0x14e/0x170
bpf_iter_tcp_batch+0x53/0x200
bpf_iter_tcp_seq_next+0x27/0x70
bpf_seq_read+0x107/0x410
vfs_read+0xb9/0x380
The iterator's stolen reference is lost when the publishing CPU's
refcount_set() overwrites the count, leaving the socket one reference
short. When the last legitimate owner drops its reference the reqsk is
freed while still reachable, leading to use-after-free.
This reproduces in seconds with tcp_syncookies=0, a handful of threads
doing connect()/close() to a local listener while others read an
iter/tcp link in a tight loop.
Use refcount_inc_not_zero() and skip the socket on failure. A skipped
socket is still part of the bucket, so keep counting it in expected.
The reallocations are sized from expected, and a request sock whose
refcount gets published while the lock is held across the last realloc
must already have room.
A skipped socket is counted in expected but never batched, so end_sk
can be short of expected on a batch that is actually complete. Decide
completeness by whether the walk left any socket behind instead. The
WARN after the locked realloc checks the same, replacing an
end_sk == expected check that could not hold on that path since
commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always
contains a full bucket snapshot").
If every matching socket in a bucket is mid-init (refcount 0), end_sk
stays 0. Advance to the next bucket rather than returning a batch entry
that was never filled this round.
Severity
No CVSS data available.
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
04c7820b776f1c4b48698574c47de9e940d368e8 , < cc0295f89296ed351fc4b0b48fee887ba02c5d24
(git)
Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < ddbe966b5d1fe212ada749bc3d0b410f1a7dea74 (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 7d2b60a4bc0499f62ff8520af6309bbe170882fd (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < cefcbbe20846a45f9a7dae868f7ef1000953e2df (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < 97e74d3e45d653c07c2d406fc530a9bbe3df8396 (git) Affected: 04c7820b776f1c4b48698574c47de9e940d368e8 , < e5fd3f514e27db1f05fbd72ba615d74941e23c51 (git) |
guessed | |
| Linux | Linux |
Affected:
5.15
Unaffected: 0 , < 5.15 (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cc0295f89296ed351fc4b0b48fee887ba02c5d24",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "ddbe966b5d1fe212ada749bc3d0b410f1a7dea74",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "7d2b60a4bc0499f62ff8520af6309bbe170882fd",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "cefcbbe20846a45f9a7dae868f7ef1000953e2df",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "97e74d3e45d653c07c2d406fc530a9bbe3df8396",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
},
{
"lessThan": "e5fd3f514e27db1f05fbd72ba615d74941e23c51",
"status": "affected",
"version": "04c7820b776f1c4b48698574c47de9e940d368e8",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ipv4.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.183",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.152",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.104",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\n\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\nthe ehash chain, drops the bucket lock, and only afterwards sets\nrsk_refcnt to 3.\n\nLockless readers such as __inet_lookup_established() handle this with\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\nsock_hold() while holding the bucket lock, on the assumption that the\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\nrequest_sock:\n\n CPU 0 CPU 1\n ----- -----\n tcp_conn_request()\n reqsk_queue_hash_req()\n inet_ehash_insert(req)\n spin_lock(bucket)\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\n spin_unlock(bucket)\n bpf_iter_tcp_established_batch()\n spin_lock(bucket)\n sock_hold(req) \u003c-- addition on 0\n spin_unlock(bucket)\n refcount_set(\u0026req-\u003ersk_refcnt, 3) // clobbers saturated value\n\nwhich surfaces as:\n\n refcount_t: addition on 0; use-after-free.\n WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\n Call Trace:\n bpf_iter_tcp_established_batch+0x14e/0x170\n bpf_iter_tcp_batch+0x53/0x200\n bpf_iter_tcp_seq_next+0x27/0x70\n bpf_seq_read+0x107/0x410\n vfs_read+0xb9/0x380\n\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\nrefcount_set() overwrites the count, leaving the socket one reference\nshort. When the last legitimate owner drops its reference the reqsk is\nfreed while still reachable, leading to use-after-free.\n\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\ndoing connect()/close() to a local listener while others read an\niter/tcp link in a tight loop.\n\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\nsocket is still part of the bucket, so keep counting it in expected.\nThe reallocations are sized from expected, and a request sock whose\nrefcount gets published while the lock is held across the last realloc\nmust already have room.\n\nA skipped socket is counted in expected but never batched, so end_sk\ncan be short of expected on a batch that is actually complete. Decide\ncompleteness by whether the walk left any socket behind instead. The\nWARN after the locked realloc checks the same, replacing an\nend_sk == expected check that could not hold on that path since\ncommit cdec67a489d4 (\"bpf: tcp: Make sure iter-\u003ebatch always\ncontains a full bucket snapshot\").\n\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\nstays 0. Advance to the next bucket rather than returning a batch entry\nthat was never filled this round."
}
],
"providerMetadata": {
"dateUpdated": "2026-08-22T15:33:09.643Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24"
},
{
"url": "https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74"
},
{
"url": "https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd"
},
{
"url": "https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df"
},
{
"url": "https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396"
},
{
"url": "https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51"
}
],
"title": "bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74714",
"datePublished": "2026-08-22T15:33:09.643Z",
"dateReserved": "2026-08-15T05:44:03.928Z",
"dateUpdated": "2026-08-22T15:33:09.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2026-74714\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:46.170\",\"lastModified\":\"2026-08-22T16:16:46.170\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()\\n\\nreqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto\\nthe ehash chain, drops the bucket lock, and only afterwards sets\\nrsk_refcnt to 3.\\n\\nLockless readers such as __inet_lookup_established() handle this with\\nrefcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain\\nsock_hold() while holding the bucket lock, on the assumption that the\\nlock guarantees sk_refcnt \u003e 0. That assumption does not hold for\\nrequest_sock:\\n\\n CPU 0 CPU 1\\n ----- -----\\n tcp_conn_request()\\n reqsk_queue_hash_req()\\n inet_ehash_insert(req)\\n spin_lock(bucket)\\n __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0\\n spin_unlock(bucket)\\n bpf_iter_tcp_established_batch()\\n spin_lock(bucket)\\n sock_hold(req) \u003c-- addition on 0\\n spin_unlock(bucket)\\n refcount_set(\u0026req-\u003ersk_refcnt, 3) // clobbers saturated value\\n\\nwhich surfaces as:\\n\\n refcount_t: addition on 0; use-after-free.\\n WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1\\n Call Trace:\\n bpf_iter_tcp_established_batch+0x14e/0x170\\n bpf_iter_tcp_batch+0x53/0x200\\n bpf_iter_tcp_seq_next+0x27/0x70\\n bpf_seq_read+0x107/0x410\\n vfs_read+0xb9/0x380\\n\\nThe iterator\u0027s stolen reference is lost when the publishing CPU\u0027s\\nrefcount_set() overwrites the count, leaving the socket one reference\\nshort. When the last legitimate owner drops its reference the reqsk is\\nfreed while still reachable, leading to use-after-free.\\n\\nThis reproduces in seconds with tcp_syncookies=0, a handful of threads\\ndoing connect()/close() to a local listener while others read an\\niter/tcp link in a tight loop.\\n\\nUse refcount_inc_not_zero() and skip the socket on failure. A skipped\\nsocket is still part of the bucket, so keep counting it in expected.\\nThe reallocations are sized from expected, and a request sock whose\\nrefcount gets published while the lock is held across the last realloc\\nmust already have room.\\n\\nA skipped socket is counted in expected but never batched, so end_sk\\ncan be short of expected on a batch that is actually complete. Decide\\ncompleteness by whether the walk left any socket behind instead. The\\nWARN after the locked realloc checks the same, replacing an\\nend_sk == expected check that could not hold on that path since\\ncommit cdec67a489d4 (\\\"bpf: tcp: Make sure iter-\u003ebatch always\\ncontains a full bucket snapshot\\\").\\n\\nIf every matching socket in a bucket is mid-init (refcount 0), end_sk\\nstays 0. Advance to the next bucket rather than returning a batch entry\\nthat was never filled this round.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/tcp_ipv4.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"cc0295f89296ed351fc4b0b48fee887ba02c5d24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"ddbe966b5d1fe212ada749bc3d0b410f1a7dea74\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"7d2b60a4bc0499f62ff8520af6309bbe170882fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"cefcbbe20846a45f9a7dae868f7ef1000953e2df\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"97e74d3e45d653c07c2d406fc530a9bbe3df8396\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"04c7820b776f1c4b48698574c47de9e940d368e8\",\"lessThan\":\"e5fd3f514e27db1f05fbd72ba615d74941e23c51\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/tcp_ipv4.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.15\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.15\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…