bpf: tcp: fix double sock release on batch realloc
CVSS score
7.8
EPSS probability
%0.1
Risk score
0.0
Published
2 mo ago
Kanıt listesindeki ürün ve sürüm eşleşmesini kontrol edin; bazı varyantlar hâlâ etkileniyor olabilir.
Impact on My Inventory
Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.
Checking session…
Vulnerability description
CVE AI research
DayBreach AI Explanation
Verified against sourcesSources read
2
Source agreement
Tam uyum
Evidence confidence
%58
Short explanation
CVE-2026-64575 is a Linux kernel vulnerability in the bpf: tcp module affecting specific versions prior to cdec67a489d4fdae3e83e04fca0419136a83c4c2. It involves a double socket release during batch reallocation, leading to a null pointer dereference. No fixed version is documented. Patch status is UNKNOWN. No evidence of active exploitation or public PoC exists.
This vulnerability could allow a local attacker with root privileges to trigger a kernel panic via a crafted BPF program. While no public PoC exists, the potential for kernel instability under specific conditions remains a concern for systems using BPF-based TCP monitoring.
The sources give limited detail on some technical conditions. Review the chain of evidence below before deciding how to act.
Chain of evidence and sources
CVE-2026-64575, Linux çekirdeğinde bpf: tcp modülüne ait bir eksiklik, cdec67a489d4fdae3e83e04fca0419136a83c4c2'den önceki sürümlerde etkilidir. Etkilenen sürümler arasında 9f27c4f0ae35b5390ce4f7a54d3501144e41a54d, 8a726e9585ffe7bfbfad2b5279277a00973970f3 ve 980a813452754f8001704744e92f7aa697c53dd3'dür. Eksiklik, batch yeniden ayarlanma sırasında iki kez soket serbest bırakma ile ilgili olup, __sock_gen_cookie'da null işaretçi dereferansına neden olur.
Eksiklik Linux çekirdeğinde düzeltildi ancak mevcut kaynaklarda belirtilen bir düzeltme sürümü yoktur. Düzeltme durumu BİLGİSİZ çünkü resmî kaynaklarda güvenilir bilgi yoktur.
Aktif istismar veya açık bir PoC gösterilmemiştir. CISA KEV veya NVD'de bu eksiklik, istismar durumu ya da ransomware kullanımına dair bilgi yoktur. CVE-2026-64575, CWE'ler ya da ransomware kullanımına dair bilgi yoktur.
Show the technical text from the sources
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers. bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr 0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Explanation produced with the local qwen3:4b-instruct model. Numerical metrics and the KEV, patch and exploit statuses are not determined by AI.
IMPACT: Affected Products and Software
Affected Products
The following products are affected by CVE-2026-64575 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.
RED HAT CSAF/VEX: Product Impact Check
SCORING: CVSS from Multiple Sources
CVSS Scores
The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.
| SCORE | VERSION | SEVERITY | VECTOR | SOURCE |
|---|---|---|---|---|
| 7.8 | CVSS V31 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD |
| 7.8 | CVSS V3_1 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CVE CNA |
Patch and Remediation Guide
Solution & Remediation Advisory
1 düzeltme kanıtı bulundu; en az 1 ürün veya sürüm hâlâ etkileniyor ya da inceleniyor.
7.1.6-1Debian sid: 7.1.6-1
Public exploit and active exploitation status
Verified exploit intelligence
No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.
Weakness Classification and Attack Patterns (CWE & CAPEC)
CWE - Common Weakness Enumeration
While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-64575 is associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-64575 weaknesses.
Attack Vector and Accessibility
Official Sources and Advisories
Similar Vulnerabilities
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-64575"