Linux kernel sk_clone: early bailout frees the parent socket's BPF storage, causing a use-after-free

Impact

sock_copy() shallow-copies ->sk_bpf_storage into the new socket. If sk_clone() bails out before bpf_sk_storage_clone() runs - for example when sk_filter_charge() fails - the clone is freed while still pointing at the parent socket's BPF local storage, and __sk_destruct() destroys storage the parent is still using. That is a use-after-free on a live socket reachable from the normal accept path. This matters on GPU nodes because BPF socket-local storage is what CNI dataplanes such as Cilium and most eBPF observability agents use, so the affected code is in the hot path on an ordinary Kubernetes worker rather than in an exotic subsystem. Impact is kernel memory corruption, so a host crash that drops every GPU pod on the node, or privilege escalation on a shared node.

Who can reach it

Local. A workload that can create sockets on a host whose sockets carry BPF local storage, and that can drive sk_clone() into its early error path (for example by exhausting the socket filter memory charge). No authentication beyond running code on the node, so any tenant pod qualifies on a node with an eBPF CNI.

What to do

Take the stable kernel fix - sk_clone() now clears newsk->sk_bpf_storage immediately after sock_copy() - and reboot each node. No mitigation short of removing the eBPF programs that attach socket-local storage, which on an eBPF CNI means losing the dataplane. Drain and reboot on the normal kernel-update rotation unless the fleet is multi-tenant, which raises the priority.

References

Related entries

• Linux kernel mlx5_core MACsec offload: Deleting an offloaded MACsec RX secure channel frees the per-SC metadata_dstCVE-2026-72072 · Linux kernel mlx5_core MACsec offloadHigh
• Linux kernel bpf: fork bailout frees an uninitialized task->bpf_storage, causing UAF or hangCVE-2026-72110 · Linux kernel BPF task local storage (copy_process / free_task bailout)High
• Linux kernel mm: DAX hotplug into an early section leaves ZONE_DEVICE tail struct pages uninitializedCVE-2026-72172 · Linux kernel mm/mm_init (ZONE_DEVICE compound_nr_pages on early sections)High
• Linux kernel (arch/x86/kvm/vmx): The nested vTPR versus TPR-threshold consistency check ran only after KVM had alreadyCVE-2026-72287 · Linux kernel (arch/x86/kvm/vmx)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): A use-after-free in the amdkfd (KFD compute driverCVE-2026-72449 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (net/xfrm): Xfrm_selector_match() compared selectors without checking that the selector family matches theCVE-2026-72450 · Linux kernel (net/xfrm)High