---
id: CVE-2026-68284
title: 'bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

  tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
  drops and reacquires the socket lock.  …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    0688e6fe599d2d39147ae9ece97944c6e1815ebf
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    b2bcbeabfd843d47468fa095b1bd08ddb90cf616
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    54be47e7cbb936429c3bbdfc526ea943954aaf80
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    ee762f684eefa59de34d9ed93cab08336e834f47
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    cde4d6bcd9b73073c66498f6723c7b364c4dbc18
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    786d690257ec7a0c839f8710456e444ce3f1348b
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    752b1159ed5d0c48fe169a3721b96660a9822aa1
  - >-
    Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c <
    2d66a033864e27ab8d5e44cb36f31d9d2413bee4
  - Linux 4.20
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:46:33.864710Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:06.141Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68284'
references:
  - url: 'https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf'
  - url: 'https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616'
  - url: 'https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80'
  - url: 'https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47'
  - url: 'https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18'
  - url: 'https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b'
  - url: 'https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1'
  - url: 'https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4'
tags:
  - cve.org
epss: 0.00135
epssPercentile: 0.02627
ingestedAt: '2026-10-16T17:24:46.853Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which
drops and reacquires the socket lock.  Its error path tries to decide
whether msg_tx names the local temporary message by comparing it with
the current value of psock->cork.

This comparison is unsafe when two threads send on the same socket:

  Thread A                         Thread B
  msg_tx = psock->cork
  sk_msg_alloc() fails
  sk_stream_wait_memory()
    releases the socket lock      acquires the socket lock
                                  completes the cork
                                  psock->cork = NULL
                                  frees the cork
    reacquires the socket lock
  msg_tx != psock->cork
  sk_msg_free(msg_tx)

The stale cork is therefore mistaken for the local temporary message
and freed again.  KASAN reported:

  BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50
  Read of size 4 at addr ffff88810c908800 by task poc/90
  Call Trace:
   sk_msg_free+0x49/0x50
   tcp_bpf_sendmsg+0x14f5/0x1cc0
   __sys_sendto+0x32c/0x3a0
   __x64_sys_sendto+0xdb/0x1b0
  Allocated by task 89:
   __kasan_kmalloc+0x8f/0xa0
   tcp_bpf_sendmsg+0x16b3/0x1cc0
  Freed by task 91:
   __kasan_slab_free+0x43/0x70
   kfree+0x131/0x3c0
   tcp_bpf_sendmsg+0xec3/0x1cc0

msg_tx can only name the stack-local tmp or the shared cork. Check for
tmp directly so a changed psock->cork cannot turn a shared message into
an apparent local one.

## Affected

- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < 0688e6fe599d2d39147ae9ece97944c6e1815ebf`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < b2bcbeabfd843d47468fa095b1bd08ddb90cf616`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < 54be47e7cbb936429c3bbdfc526ea943954aaf80`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < ee762f684eefa59de34d9ed93cab08336e834f47`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < cde4d6bcd9b73073c66498f6723c7b364c4dbc18`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < 786d690257ec7a0c839f8710456e444ce3f1348b`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < 752b1159ed5d0c48fe169a3721b96660a9822aa1`
- `Linux >= 604326b41a6fb9b4a78b6179335decee0365cd8c < 2d66a033864e27ab8d5e44cb36f31d9d2413bee4`
- `Linux 4.20`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.