Linux kernel BPF sockmap: use-after-free on the cached redirect socket in the send verdict path

Impact

tcp_bpf_send_verdict() copies psock->sk_redir while holding the source socket lock but takes no reference for its local copy before dropping that lock around tcp_bpf_sendmsg_redir(). A concurrent sendmsg() on the same socket can consume the remaining apply_bytes, clear the cached verdict and drop the last reference, freeing the redirect socket while the first thread still dereferences the raw pointer. KASAN confirms a slab-use-after-free read. On nodes running a sockmap-based data path - Cilium and similar service meshes accelerate east-west traffic this way - this is a racy kernel UAF reachable from ordinary socket writes, which means a crash at minimum and a plausible privilege-escalation primitive on a shared node.

Who can reach it

Local: a process whose sockets are in a sockmap with a send verdict program attached, issuing concurrent sendmsg() calls on the same socket from two threads. Installing the sockmap program itself needs CAP_BPF/root, so the exposure is on nodes where the platform already runs such a program and tenants supply the traffic.

What to do

Take the patched kernel from the linked stable commits, which hold a temporary reference across the unlocked call. Rolling out means installing the kernel and rebooting each node - no module reload or livepatch is offered in the record. Where a sockmap acceleration layer is optional, disabling it removes the path until the reboot window.

References

Related entries

• Linux kernel mm/filemap: page cache folio can be stored at the wrong index after an allocation retryCVE-2026-74591 · Linux kernel mm/filemap (__filemap_add_folio index restore on retry)Unscored
• Linux kernel IMA: truncation does not invalidate cached measurements, leaving stale appraisal stateCVE-2026-74592 · Linux kernel IMA (missing file_truncate / path_truncate LSM hooks)Unscored
• Linux kernel sched_ext: lock inversion between scx_cgroup_lock and cgroup_mutex deadlocks the nodeCVE-2026-74593 · Linux kernel sched_ext (scx_cgroup_lock ordering against cgroup_mutex)Unscored
• Linux kernel PSI: rtpoll timer can outlive its cgroup and fire on freed memoryCVE-2026-74594 · Linux kernel sched/psi (rtpoll_timer lifetime vs psi_cgroup_free)Unscored
• Linux kernel page_table_check: unprivileged zero mappings overflow the file map counter and panic the hostCVE-2026-74600 · Linux kernel mm/page_table_check (zero-page and huge-zero PMD accounting)Unscored
• KVM SVM SEV: races between encryption-context move and copy corrupt the mirror list and misdirect a VM referenceCVE-2026-74607 · KVM SVM SEV (owner/mirror VM list serialisation across MOVE_ENC_CONTEXT_FROM and COPY_ENC_CONTEXT_FROM)Unscored