Linux kernel sockmap: backlog worker uses a freed socket when a mapped socket is closed concurrently

Impact

The sockmap backlog worker calls skb_send_sock() without holding a reference to sk->sk_socket. If the owning fd is closed at the same time, sock_map_close() clears sk_socket->ops and frees the socket while the worker is inside sock_sendmsg(), giving a use-after-free with an attacker-influenced timing window. The upstream report includes a reproduced kernel panic. All socket families routed through sockmap are affected - TCP, UDP, UNIX and vsock. This matters on GPU nodes because sockmap is the fast path behind Cilium-style socket-level load balancing and sidecar-less service mesh acceleration, so the vulnerable code is live on the host kernel that every tenant pod shares. A use-after-free in that path is a host-kernel memory-corruption primitive, not a pod-scoped fault: the blast radius is the whole node and every colocated tenant.

Who can reach it

Local. Requires the ability to place sockets into a sockmap or to run on a node where a CNI or service mesh does so, plus the ability to close a mapped socket while the backlog worker is draining it. No authentication beyond local code execution in a context whose sockets are sockmap-managed.

What to do

Patch to a stable kernel containing the psock reference-count fix (sk_psock_get() around the backlog send path; see the linked commits for per-branch backports) and reboot. Rollout cost is drain plus reboot per node - there is no module reload path for this while a CNI is actively using sockmap. As an interim mitigation, disabling socket-level load balancing or sockmap acceleration in the CNI removes the exposed code path, at a measurable performance cost.

References

Related entries

• Linux kernel (net/tls): A BPF verdict that grows the scatterlist (bpf_msg_push_data) combined with a cork_bytes settingCVE-2025-38166 · Linux kernel (net/tls)High
• Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure): After the change that reconnects theCVE-2025-38209 · Linux kernel nvme-tcp (admin tag set leak on secure-concatenation setup failure)High
• Linux kernel megaraid_sas: invalid NUMA node index causes an out-of-bounds access during driver probeCVE-2025-38239 · Linux kernel megaraid_sas driver (MSI-X vector allocation node index)High
• Linux kernel (posix-cpu-timers): TOCTOU race between handle_posix_cpu_timers() and posix_cpu_timer_del()CVE-2025-38352 · Linux kernel (posix-cpu-timers)High
• Linux kernel virtio-net: unchecked received length in xdp_linearize_page allows an out-of-bounds readCVE-2025-38375 · Linux kernel virtio-net (xdp_linearize_page received-length check)High
• Linux i915 GPU kernel driver (GT timeline / VMA allocation): A timeline is left held when VMA allocation fails, soCVE-2025-38389 · Linux i915 GPU kernel driver (GT timeline / VMA allocation)High