« Volver al listado

CVE-2026-68386

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject unhashed UDP sockets on sockmap update

UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.

Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak.

Instead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions:

Leer descripción completaMostrar menos

Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign").

Detalles técnicos trazas, registros y código del informe original
unreferenced object 0xffff88810bc2eb40 (size 1984):
  comm "test_progs", pid 2451, jiffies 4295320596
  hex dump (first 32 bytes):
    7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00  ................
    02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace (crc bdee079d):
    kmem_cache_alloc_noprof+0x557/0x660
    sk_prot_alloc+0x69/0x240
    sk_alloc+0x30/0x460
    inet_create+0x2ce/0xf80
    __sock_create+0x25b/0x5c0
    __sys_socket+0x119/0x1d0
    __x64_sys_socket+0x72/0xd0
    do_syscall_64+0xa1/0x5f0
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

1. sock_map_sk_state_allowed() maintains a fall-through `return true`.
2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash
   handler for BPF sockmap usage"), the proto::unhash BPF handler is not
   reintroduced.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-68386",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "lessThan": "8692655da369961128658cf8539334b6a960ecb0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.15",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-10T13:20:31.823",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket's refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n  comm \"test_progs\", pid 2451, jiffies 4295320596\n  hex dump (first 32 bytes):\n    7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00  ................\n    02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............\n  backtrace (crc bdee079d):\n    kmem_cache_alloc_noprof+0x557/0x660\n    sk_prot_alloc+0x69/0x240\n    sk_alloc+0x30/0x460\n    inet_create+0x2ce/0xf80\n    __sock_create+0x25b/0x5c0\n    __sys_socket+0x119/0x1d0\n    __x64_sys_socket+0x72/0xd0\n    do_syscall_64+0xa1/0x5f0\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n   handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n   reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."
    }
  ],
  "lastModified": "2026-08-19T17:20:47.260",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}