CVE-2026-22977: Linux Kernel Use-After-Free Vulnerability

CVE-2026-22977 Overview

CVE-2026-22977 is a Linux kernel vulnerability in the networking subsystem that triggers a hardened usercopy panic in sock_recv_errqueue(). The flaw stems from skbuff_fclone_cache being created without a usercopy whitelist region, unlike skbuff_head_cache which properly whitelists the cb[] field. When CONFIG_HARDENED_USERCOPY is enabled, copying sk_buff.cb data to userspace via put_cmsg() causes __check_heap_object() to fail, resulting in a kernel BUG(). The issue affects kernels including the 6.19 release candidates and earlier stable branches. Local unprivileged users can trigger the panic through standard socket error queue operations.

Critical Impact
A local user can trigger a kernel BUG() and denial of service by reading the socket error queue with recvmsg(MSG_ERRQUEUE) on TLS or TCP sockets when CONFIG_HARDENED_USERCOPY is active.

Affected Products

Linux kernel stable branches prior to the fix commits
Linux kernel 6.19-rc1, 6.19-rc2, 6.19-rc3, 6.19-rc4
Distributions shipping kernels with CONFIG_HARDENED_USERCOPY enabled

Discovery Timeline

2026-01-21 - CVE-2026-22977 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-22977

Vulnerability Analysis

The vulnerability resides in the interaction between the Linux sk_buff cloning infrastructure and the hardened usercopy subsystem. The kernel maintains two separate SLUB caches for socket buffers: skbuff_head_cache and skbuff_fclone_cache. The former defines a usercopy whitelist for the cb[] control buffer, allowing safe copying to userspace. The latter cache, used for fast-cloned skbs, omits this whitelist entirely.

When TCP allocates an skb through alloc_skb_fclone() and later clones it via skb_clone(), the cloned skb originates from skbuff_fclone_cache. If that cloned skb is queued to sk_error_queue for timestamp or error reporting, a subsequent recvmsg(MSG_ERRQUEUE) call drives sock_recv_errqueue() into put_cmsg(). The put_cmsg() path invokes __check_object_size(), which calls __check_heap_object() and detects that the source object lacks a usercopy region. The kernel then invokes usercopy_abort(), producing a BUG() at mm/usercopy.c:102 and an oops on the calling CPU. This maps to [CWE-476] in the assigned weakness classification.

Root Cause

The root cause is missing usercopy whitelist metadata on skbuff_fclone_cache. The crash offset 296 corresponds to skb2->cb inside the fclones structure: 232 bytes for sizeof(struct sk_buff) plus a 40-byte cb offset yields 272, and the sock_exterr_skb.ee field sits at +24 inside cb. Without a declared whitelist covering this region, hardened usercopy treats any read into skb->cb from a cloned fclone as a kernel memory exposure attempt.

Attack Vector

A local user with the ability to open a TCP or TLS socket can reach the vulnerable path. The attacker enables socket timestamping or error reporting, induces an event that queues a cloned skb to sk_error_queue, and reads the queue with recvmsg(MSG_ERRQUEUE). No elevated privileges are required beyond standard socket access. The result is a kernel oops on the executing CPU, leading to process termination and potential system instability. The reproducer shown in the upstream report uses tls_sw_recvmsg() as the entry path.

No public exploit code or proof-of-concept URLs are referenced in the advisory data. See the upstream kernel commit for the corrective patch details.

Detection Methods for CVE-2026-22977

Indicators of Compromise

Kernel log entries containing usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache'
kernel BUG at mm/usercopy.c:102 messages in dmesg or /var/log/kern.log
Oops traces showing usercopy_abort → __check_heap_object → put_cmsg → sock_recv_errqueue call sequence
Repeated process crashes from unprivileged users calling recvmsg with MSG_ERRQUEUE

Detection Strategies

Monitor kernel ring buffer for usercopy abort signatures originating from skbuff_fclone_cache
Correlate kernel oops events with the originating UID and process name to identify suspicious local activity
Audit running kernel version against the fixed stable commits listed in the vendor advisories
Track repeated MSG_ERRQUEUErecvmsg system calls from non-root processes in audit logs

Monitoring Recommendations

Forward kern.log and dmesg output to a centralized log platform for pattern detection
Alert on any occurrence of usercopy_abort or mm/usercopy.c BUG strings across the fleet
Inventory Linux hosts and confirm whether CONFIG_HARDENED_USERCOPY is set in /boot/config-$(uname -r)
Review auditd records for unusual socket option configurations such as SO_TIMESTAMPING followed by MSG_ERRQUEUE reads

How to Mitigate CVE-2026-22977

Immediate Actions Required

Apply the upstream stable patches referenced in the kernel.org commit list and reboot affected systems
Subscribe to your distribution's security feed and install kernel updates that incorporate the fix commits
Inventory kernels built with CONFIG_HARDENED_USERCOPY=y and prioritize them for patching
Restrict untrusted local accounts on hosts that cannot be patched immediately

Patch Information

The fix introduces a local stack-allocated bounce buffer in sock_recv_errqueue() so that the data passed to put_cmsg() no longer originates from skbuff_fclone_cache. This avoids the hardened usercopy check failure without altering the cache definition. Fix commits are available at the kernel.org stable tree, including commit 005671c, commit 2a71a1a, commit 582a5e9, commit 88dd6be, commit 8c6901a, commit c655d21, and commit e00b169.

Workarounds

Rebuild the kernel with CONFIG_HARDENED_USERCOPY disabled if patching is not yet possible, accepting the loss of that mitigation
Limit interactive shell access on multi-tenant Linux hosts to trusted users until kernels are updated
Disable or restrict TLS socket usage and SO_TIMESTAMPING for low-privilege workloads where feasible

bash

# Verify kernel version and hardened usercopy configuration
uname -r
grep CONFIG_HARDENED_USERCOPY /boot/config-$(uname -r)

# Check for prior occurrences of the crash signature
dmesg | grep -E 'usercopy|skbuff_fclone_cache'
journalctl -k --since '7 days ago' | grep -E 'mm/usercopy.c|usercopy_abort'