CVE-2026-74589
Estado: RecibidaAlta (8.4)—
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix sk_redir use-after-free in send verdict
sk_psock_msg_verdict() takes a socket reference for psock->sk_redir. tcp_bpf_send_verdict() copies that pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock around tcp_bpf_sendmsg_redir().
When apply_bytes keeps the cached verdict active, another sendmsg() on the same source socket can consume the remaining bytes and release the cached reference while the first thread still holds only the raw local pointer:
Leer descripción completaMostrar menos
The final sock_put() can free sk_redir before CPU 0 dereferences it.
Take a temporary socket reference while the source socket lock still protects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir() returns. This keeps each unlocked use independent of cached-verdict ownership.
Detalles técnicos trazas, registros y código del informe original
CPU 0 CPU 1
sk_redir = psock->sk_redir
apply_bytes remains nonzero
release_sock(sk)
lock_sock(sk)
apply_bytes reaches zero
psock->sk_redir = NULL
release_sock(sk)
tcp_bpf_sendmsg_redir(sk_redir)
sock_put(sk_redir)
tcp_bpf_sendmsg_redir(sk_redir)
KASAN reported:
BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020
Read of size 8 at addr ffff888108537090 by task poc/87
Call Trace:
tcp_bpf_sendmsg_redir+0xf39/0x1020
tcp_bpf_sendmsg+0x977/0x1a50
__sys_sendto+0x32c/0x3a0
__x64_sys_sendto+0xdb/0x1b0
Allocated by task 85:
sk_prot_alloc+0x56/0x210
sk_clone+0x6f/0x14b0
inet_csk_clone_lock+0x24/0x740
tcp_create_openreq_child+0x25/0x2710
tcp_v4_syn_recv_sock+0x10a/0xe00
Freed by task 0:
__kasan_slab_free+0x43/0x70
slab_free_after_rcu_debug+0xa6/0x1e0
rcu_core+0x50a/0x1850
Last potentially related work creation:
__sk_destruct+0x3da/0x540
sk_psock_destroy+0x81e/0xab0
process_one_work+0x63a/0x1070CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.4
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.14%
- Percentil entre todas las CVEs puntuadas: 3
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation60 %
Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e
- https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf
- https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf
- https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99
- https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3
- https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10
- https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558
- https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-74589",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.4,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.5
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "90a19b0894ba79a699b48cf44421b36fbd566e99",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "d192cff2a37d59206dabe6ec2e60ceac6271f274",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "1cec526cf0a2227395f2c2f4b671cb052ff0b00e",
"versionType": "git"
},
{
"status": "affected",
"version": "604326b41a6fb9b4a78b6179335decee0365cd8c",
"lessThan": "a76624733730e541e4955fdecf506af2f6b20558",
"versionType": "git"
}
],
"programFiles": [
"net/ipv4/tcp_bpf.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.20",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.265",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.216",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.183",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.152",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.104",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/ipv4/tcp_bpf.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-08-22T16:16:31.097",
"references": [
{
"url": "https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix sk_redir use-after-free in send verdict\n\nsk_psock_msg_verdict() takes a socket reference for psock->sk_redir.\ntcp_bpf_send_verdict() copies that pointer while holding the source socket\nlock, but does not take a reference for the local copy before dropping the\nlock around tcp_bpf_sendmsg_redir().\n\nWhen apply_bytes keeps the cached verdict active, another sendmsg() on the\nsame source socket can consume the remaining bytes and release the cached\nreference while the first thread still holds only the raw local pointer:\n\n CPU 0 CPU 1\n sk_redir = psock->sk_redir\n apply_bytes remains nonzero\n release_sock(sk)\n lock_sock(sk)\n apply_bytes reaches zero\n psock->sk_redir = NULL\n release_sock(sk)\n tcp_bpf_sendmsg_redir(sk_redir)\n sock_put(sk_redir)\n tcp_bpf_sendmsg_redir(sk_redir)\n\nThe final sock_put() can free sk_redir before CPU 0 dereferences it.\n\nKASAN reported:\n\n BUG: KASAN: slab-use-after-free in tcp_bpf_sendmsg_redir+0xf39/0x1020\n Read of size 8 at addr ffff888108537090 by task poc/87\n Call Trace:\n tcp_bpf_sendmsg_redir+0xf39/0x1020\n tcp_bpf_sendmsg+0x977/0x1a50\n __sys_sendto+0x32c/0x3a0\n __x64_sys_sendto+0xdb/0x1b0\n Allocated by task 85:\n sk_prot_alloc+0x56/0x210\n sk_clone+0x6f/0x14b0\n inet_csk_clone_lock+0x24/0x740\n tcp_create_openreq_child+0x25/0x2710\n tcp_v4_syn_recv_sock+0x10a/0xe00\n Freed by task 0:\n __kasan_slab_free+0x43/0x70\n slab_free_after_rcu_debug+0xa6/0x1e0\n rcu_core+0x50a/0x1850\n Last potentially related work creation:\n __sk_destruct+0x3da/0x540\n sk_psock_destroy+0x81e/0xab0\n process_one_work+0x63a/0x1070\n\nTake a temporary socket reference while the source socket lock still\nprotects psock->sk_redir, and drop it after tcp_bpf_sendmsg_redir()\nreturns. This keeps each unlocked use independent of cached-verdict\nownership."
}
],
"lastModified": "2026-08-25T06:18:33.760",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}