CVE-2026-64575: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64575 Overview

CVE-2026-64575 is a Linux kernel vulnerability in the BPF TCP iterator (bpf_iter_tcp_batch()). The flaw causes a double release of socket references when a batch reallocation fails. On the failure path, bpf_iter_tcp_put_batch() drops socket references and overwrites each slot with a socket cookie. The function then returns ERR_PTR() while leaving cur_sk < end_sk, so bpf_iter_tcp_seq_stop() re-invokes bpf_iter_tcp_put_batch() and dereferences a cookie value as a struct sock pointer. This triggers a null-pointer dereference and kernel panic reported by KASAN.

Critical Impact
Local unprivileged triggering of the BPF TCP iterator can cause a kernel panic through a null-pointer dereference in __sock_gen_cookie, resulting in denial of service.

Affected Products

Linux kernel versions containing the vulnerable bpf_iter_tcp_batch() implementation in net/ipv4/tcp_ipv4.c
Distributions shipping kernels prior to the patches referenced in the stable tree commits
Systems exposing BPF iterators to unprivileged workloads or containers with CAP_BPF

Discovery Timeline

2026-08-05 - CVE-2026-64575 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64575

Vulnerability Analysis

The vulnerability resides in the BPF TCP socket iterator used to enumerate TCP sockets from BPF programs. bpf_iter_tcp_batch() grows its internal batch when it cannot fit all sockets in the current bucket. Before growing, it calls bpf_iter_tcp_put_batch(), which releases each socket reference and replaces the slot with the socket's 64-bit cookie value for use by bpf_iter_tcp_resume().

When the reallocation subsequently fails, the function returns ERR_PTR() without executing the resume path. However, cur_sk and end_sk still describe slots that now hold cookies rather than struct sock pointers. When bpf_iter_tcp_seq_stop() runs during cleanup, it calls bpf_iter_tcp_put_batch() a second time. That call treats each cookie as a socket pointer and dereferences it, producing the KASAN null-pointer dereference in __sock_gen_cookie at net/core/sock_diag.c:28.

Root Cause

The root cause is a state-tracking error [CWE-825, use of pointer after free-equivalent condition]. The batch slots transition from holding live socket references to holding cookies, but cur_sk/end_sk are not reset before the error return. The stop callback has no way to distinguish the two states and treats cookie values as valid struct sock pointers.

Attack Vector

An attacker with permission to attach or read a BPF TCP iterator can trigger the code path by inducing a memory allocation failure during batch growth. The read syscall on the BPF iterator file descriptor calls into bpf_seq_read(), which invokes the vulnerable batch and stop callbacks. The result is a fatal kernel exception. The upstream fix empties the batch on the failure path so stop() does not release it a second time. A later read() rescans the bucket from the start.

See the upstream fixes at Kernel Git Commit 8a726e95, Kernel Git Commit 980a8134, and Kernel Git Commit 9f27c4f0 for technical details.

Detection Methods for CVE-2026-64575

Indicators of Compromise

Kernel panic messages referencing __sock_gen_cookie, bpf_iter_tcp_put_batch, or bpf_iter_tcp_seq_stop in the call stack.
KASAN reports of null-ptr-deref at low addresses (for example 0x0000000000000059) originating from bpf_seq_read.
Unexpected process termination or host reboots correlated with workloads that read from BPF TCP iterator file descriptors.

Detection Strategies

Monitor dmesg and /var/log/kern.log for BUG: KASAN and Kernel panic - not syncing: Fatal exception entries tied to the BPF iterator call chain.
Audit BPF program loads and iterator attachments via bpf() syscall telemetry, focusing on BPF_ITER_LINK_CREATE and TCP iterator types.
Correlate host crashes with recent read() activity against /sys/fs/bpf/ iterator objects.

Monitoring Recommendations

Enable persistent kernel crash dump collection (kdump) to capture full stack traces for triage.
Alert on unprivileged or container workloads holding CAP_BPF or CAP_SYS_ADMIN that invoke BPF iterators.
Track kernel version inventory to identify hosts still exposed to the unpatched bpf_iter_tcp_batch() code path.

How to Mitigate CVE-2026-64575

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 8a726e95, 980a8134, and 9f27c4f0 or upgrade to a stable kernel release that includes them.
Restrict CAP_BPF and CAP_SYS_ADMIN in container and multi-tenant environments to limit who can attach BPF TCP iterators.
Prioritize patching on hosts that expose BPF iterator functionality to lower-trust workloads.

Patch Information

The fix empties the batch on the reallocation failure path, ensuring bpf_iter_tcp_seq_stop() does not release socket references twice. Sockets released by the first bpf_iter_tcp_put_batch() are not leaked, and a subsequent read() rescans the bucket from the beginning. Refer to the stable tree commits 8a726e95, 980a8134, and 9f27c4f0 for backport guidance.

Workarounds

Disable or restrict access to BPF TCP iterators for non-root users and container workloads until the patched kernel is deployed.
Constrain BPF usage through sysctl kernel.unprivileged_bpf_disabled=1 where operational requirements allow.
Apply seccomp filters to block the bpf() syscall for workloads that do not require it.

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf