CVE-2026-74714

bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

Published Aug 22, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto
the ehash chain, drops the bucket lock, and only afterwards sets
rsk_refcnt to 3.

Lockless readers such as __inet_lookup_established() handle this with
refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain
sock_hold() while holding the bucket lock, on the assumption that the
lock guarantees sk_refcnt > 0. That assumption does not hold for
request_sock:

CPU 0 CPU 1
----- -----
tcp_conn_request()
reqsk_queue_hash_req()
inet_ehash_insert(req)
spin_lock(bucket)
__sk_nulls_add_node_rcu(req) // rsk_refcnt == 0
spin_unlock(bucket)
bpf_iter_tcp_established_batch()
spin_lock(bucket)
sock_hold(req) <-- addition on 0
spin_unlock(bucket)
refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value

which surfaces as:

refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1
Call Trace:
bpf_iter_tcp_established_batch+0x14e/0x170
bpf_iter_tcp_batch+0x53/0x200
bpf_iter_tcp_seq_next+0x27/0x70
bpf_seq_read+0x107/0x410
vfs_read+0xb9/0x380

The iterator's stolen reference is lost when the publishing CPU's
refcount_set() overwrites the count, leaving the socket one reference
short. When the last legitimate owner drops its reference the reqsk is
freed while still reachable, leading to use-after-free.

This reproduces in seconds with tcp_syncookies=0, a handful of threads
doing connect()/close() to a local listener while others read an
iter/tcp link in a tight loop.

Use refcount_inc_not_zero() and skip the socket on failure. A skipped
socket is still part of the bucket, so keep counting it in expected.
The reallocations are sized from expected, and a request sock whose
refcount gets published while the lock is held across the last realloc
must already have room.

A skipped socket is counted in expected but never batched, so end_sk
can be short of expected on a batch that is actually complete. Decide
completeness by whether the walk left any socket behind instead. The
WARN after the locked realloc checks the same, replacing an
end_sk == expected check that could not hold on that path since
commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always
contains a full bucket snapshot").

If every matching socket in a bucket is mid-init (refcount 0), end_sk
stays 0. Advance to the next bucket rather than returning a batch entry
that was never filled this round.

Analysis

Technical impact

The Linux kernel contains a use‑after‑free bug in the BPF TCP iterator used by __bpf_iter_tcp_established_batch. The function holds a bucket lock and then calls sock_hold() on a request socket that may still have a reference count of zero, which is later overwritten by refcount_set(). This allows the reference count to be incremented from zero, resulting in a dangling reference that can be exploited to corrupt memory or trigger a kernel panic. The weakness is a classic use‑after‑free, classifying it as CWE‑911.

Affected Systems

The flaw exists in the Linux kernel itself, with the CNA listing the Generic Linux kernel as the affected product. No specific version numbers are supplied, which implies that any kernel builds containing the buggy iteration routine before the fix are vulnerable. All current kernels that expose BPF TCP iteration functionality without the patch are at risk.

Risk and Exploitability

The CVSS score is 7.8 and the EPSS value is <1%, and the KEV database does not list this vulnerability as a known exploited flaw. The lack of public exploitation data combined with the severity of a use‑after‑free suggests a moderate to high risk: an attacker could induce the bug by rapidly opening and closing TCP connections while enumerating established sockets via BPF, leading to memory corruption or kernel panic. The exploitation plausibility is increased by the bug’s activation under syncookies disabled, but no confirmed remote exploit is documented.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`04c7820b776f1c4b48698574c47de9e940d368e8`	affected	< cc0295f89296ed351fc4b0b48fee887ba02c5d24
`04c7820b776f1c4b48698574c47de9e940d368e8`	affected	< ddbe966b5d1fe212ada749bc3d0b410f1a7dea74
`04c7820b776f1c4b48698574c47de9e940d368e8`	affected	< 7d2b60a4bc0499f62ff8520af6309bbe170882fd
`04c7820b776f1c4b48698574c47de9e940d368e8`	affected	< cefcbbe20846a45f9a7dae868f7ef1000953e2df
`04c7820b776f1c4b48698574c47de9e940d368e8`	affected	< 97e74d3e45d653c07c2d406fc530a9bbe3df8396
`04c7820b776f1c4b48698574c47de9e940d368e8`	affected	< e5fd3f514e27db1f05fbd72ba615d74941e23c51

Linux

affected

Version	Status	Constraints
`5.15`	affected	—
`0`	unaffected	< 5.15
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[04c7820b776f1c4b48698574c47de9e940d368e8,cc0295f89296ed351fc4b0b48fee887ba02c5d24)`	affected	code_commit	—
`[04c7820b776f1c4b48698574c47de9e940d368e8,ddbe966b5d1fe212ada749bc3d0b410f1a7dea74)`	affected	code_commit	—
`[04c7820b776f1c4b48698574c47de9e940d368e8,7d2b60a4bc0499f62ff8520af6309bbe170882fd)`	affected	code_commit	—
`[04c7820b776f1c4b48698574c47de9e940d368e8,cefcbbe20846a45f9a7dae868f7ef1000953e2df)`	affected	code_commit	—
`[04c7820b776f1c4b48698574c47de9e940d368e8,97e74d3e45d653c07c2d406fc530a9bbe3df8396)`	affected	code_commit	—
`[04c7820b776f1c4b48698574c47de9e940d368e8,e5fd3f514e27db1f05fbd72ba615d74941e23c51)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.15`	affected	semver	—
`[0,5.15)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the workaround for bpf_iter_tcp_established_batch that uses refcount_inc_not_zero and skips sockets that cannot be safely held.
If an immediate kernel upgrade is not possible, enable TCP syncookies on the host by writing 1 to /proc/sys/net/ipv4/tcp_syncookies, which reduces the likelihood of the request sock entering the bucket with a refcount of zero.
Limit or restrict the use of BPF TCP iteration in applications or scripts that run with elevated privileges to reduce the attack surface.

Generated by OpenCVE AI on August 25, 2026 at 07:55 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.126% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd
https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396
https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24
https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df
https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74
https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51
https://lore.kernel.org/linux-cve-announce/2026082238-CVE-2026-74714-2ea9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74714
https://www.cve.org/CVERecord?id=CVE-2026-74714

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Aug 24, 2026 2:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-416

Aug 24, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026082238-CVE-2026-74714-2ea9@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74714 https://www.cve.org/CVERecord?id=CVE-2026-74714
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Aug 22, 2026 6:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3. Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt > 0. That assumption does not hold for request_sock: CPU 0 CPU 1 ----- ----- tcp_conn_request() reqsk_queue_hash_req() inet_ehash_insert(req) spin_lock(bucket) __sk_nulls_add_node_rcu(req) // rsk_refcnt == 0 spin_unlock(bucket) bpf_iter_tcp_established_batch() spin_lock(bucket) sock_hold(req) <-- addition on 0 spin_unlock(bucket) refcount_set(&req->rsk_refcnt, 3) // clobbers saturated value which surfaces as: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x48/0x90, CPU#1 Call Trace: bpf_iter_tcp_established_batch+0x14e/0x170 bpf_iter_tcp_batch+0x53/0x200 bpf_iter_tcp_seq_next+0x27/0x70 bpf_seq_read+0x107/0x410 vfs_read+0xb9/0x380 The iterator's stolen reference is lost when the publishing CPU's refcount_set() overwrites the count, leaving the socket one reference short. When the last legitimate owner drops its reference the reqsk is freed while still reachable, leading to use-after-free. This reproduces in seconds with tcp_syncookies=0, a handful of threads doing connect()/close() to a local listener while others read an iter/tcp link in a tight loop. Use refcount_inc_not_zero() and skip the socket on failure. A skipped socket is still part of the bucket, so keep counting it in expected. The reallocations are sized from expected, and a request sock whose refcount gets published while the lock is held across the last realloc must already have room. A skipped socket is counted in expected but never batched, so end_sk can be short of expected on a batch that is actually complete. Decide completeness by whether the walk left any socket behind instead. The WARN after the locked realloc checks the same, replacing an end_sk == expected check that could not hold on that path since commit cdec67a489d4 ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"). If every matching socket in a bucket is mid-init (refcount 0), end_sk stays 0. Advance to the next bucket rather than returning a batch entry that was never filled this round.
Title		bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396 https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24 https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74 https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51