Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-free

Impact

reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock into the ehash and only sets rsk_refcnt afterwards, while bpf_iter_tcp_established_batch() takes a plain sock_hold() under the bucket lock on the assumption the refcount is already non-zero. The publisher's refcount_set() then clobbers the iterator's reference, leaving the socket one short; when the last legitimate owner drops it the reqsk is freed while still reachable on the hash chain. The report says it reproduces in seconds with a handful of connect()/close() threads against a local listener while another loop reads an iter/tcp link. On a GPU node the cost is a panic under the observability agent that reads TCP iterators, taking every rank pinned to that node with it.

Who can reach it

The iterator half is privileged: reading a bpf_iter TCP link needs CAP_BPF/CAP_NET_ADMIN, so it is a socket-tracing or observability daemon, not a tenant pod. The racing half is ordinary inbound TCP connection churn against a listener, which any tenant or remote client can generate.

What to do

Update to a stable kernel with the fix and reboot the node. Until the window opens, the exposure is bounded by which daemons load and read TCP iterators - auditing that set costs less than an unscheduled drain. The reproducer described in the record runs with tcp_syncookies=0, but the record does not establish syncookies as a mitigation, so do not treat flipping it as a fix.

References

Related entries

• Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference countCVE-2026-74715 · Linux kernel BPF conntrack kfuncs (opts->netns_id get/put pairing)Unscored
• Linux kernel SMC-R: duplicate LLC link messages from a peer leak one kmalloc-96 object eachCVE-2026-74719 · Linux kernel SMC-R LLC event handler (duplicate CONFIRM_LINK / ADD_LINK_CONT qentry)Unscored
• Linux kernel BPF verifier: commuted pointer arithmetic loses pointer provenance stateCVE-2026-74720 · Linux kernel BPF verifier (adjust_ptr_min_max_vals, scalar += pointer)Unscored
• Linux kernel sched_ext: a failed sub-scheduler enable races root disable into a use-after-freeCVE-2026-74731 · Linux kernel sched_ext (scx_sub_disable teardown of never-linked sub-schedulers)Unscored
• Microsoft Hyper-V: vmswitch fails to validate guest OID requestsCVE-2021-28476 · Microsoft Hyper-VCritical
• Incus: instance snapshots bypass restricted.containers.lowlevel, giving command execution on the hostCVE-2026-48751 · Incus (instance snapshots ignore restricted.containers.lowlevel)Critical