CVE-2026-68379 Overview
CVE-2026-68379 is a memory leak vulnerability in the Linux kernel's TCP stack. The flaw affects both IPv4 and IPv6 receive paths when a Per-Segment Protection (PSP) policy check fails on a TIME_WAIT socket. The kernel fails to release the TIME_WAIT socket reference before discarding the packet, leaking tcp_tw_bucket structures over time. Attackers can trigger repeated PSP policy failures across the network to exhaust kernel memory and degrade or crash the host.
Critical Impact
Remote, unauthenticated attackers can exhaust kernel memory by triggering repeated PSP policy failures, leading to denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing the PSP policy check on TCP TIME_WAIT sockets
- Systems processing IPv4 TCP traffic through the affected receive path
- Systems processing IPv6 TCP traffic through the affected receive path
Discovery Timeline
- 2026-08-10 - CVE-2026-68379 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68379
Vulnerability Analysis
The vulnerability resides in the Linux kernel's TCP receive path handling for TIME_WAIT sockets. When an incoming TCP segment matches a TIME_WAIT socket, the kernel performs a PSP policy check to validate the segment against configured protection rules. If the check fails, the kernel discards the packet but does not release the socket reference acquired during lookup. Each failure permanently increments the refcount on a tcp_tw_bucket structure, preventing its eventual deallocation.
The issue affects both the tcp_v4_rcv and tcp_v6_rcv code paths. Because TIME_WAIT sockets already carry a shortened kernel lifecycle and are allocated frequently on busy servers, the leak compounds quickly under sustained abuse.
Root Cause
The root cause is a missing inet_twsk_put() call on the PSP policy failure branch. The corrected code path releases the TIME_WAIT socket reference and jumps to the discard_it label, mirroring the handling used for other early-discard conditions in the receive path.
Attack Vector
An unauthenticated remote attacker can send TCP segments crafted to match existing TIME_WAIT socket entries while violating the configured PSP policy. Each rejected segment leaks a tcp_tw_bucket reference. Sustained traffic drives kernel slab consumption upward until the system exhausts memory available for network state, degrading TCP service or triggering out-of-memory conditions. No authentication, user interaction, or local access is required.
See the upstream fixes at Kernel Git Commit 2c1931a, Kernel Git Commit 374742a, and Kernel Git Commit e666af5 for technical details.
Detection Methods for CVE-2026-68379
Indicators of Compromise
- Steadily increasing TCP slab allocations reported by /proc/slabinfo for tcp_tw_bucket or tw_sock_TCP caches without a corresponding rise in legitimate connections.
- Growth in kernel SLAB memory usage that does not shrink after TIME_WAIT expiration windows elapse.
- Elevated rates of dropped TCP segments correlated with PSP policy enforcement counters.
Detection Strategies
- Monitor netstat -s and /proc/net/netstat for anomalous TIME_WAIT counts and TCP policy drop counters.
- Baseline kernel slab cache growth and alert when tw_sock_TCP allocations diverge from historical patterns.
- Correlate PSP policy failure events with source IP ranges to identify hosts sending policy-violating traffic.
Monitoring Recommendations
- Enable telemetry collection for kernel memory pressure indicators and OOM killer activity on Linux hosts.
- Track TCP TIME_WAIT bucket counts through node exporters and forward metrics to a centralized SIEM.
- Alert on repeated PSP policy failures originating from a small set of remote sources.
How to Mitigate CVE-2026-68379
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits 2c1931a, 374742a, and e666af5.
- Update to a distribution kernel release that incorporates the PSP policy failure reference-release fix.
- Restart affected hosts after patching to clear any leaked tcp_tw_bucket allocations.
Patch Information
The fix releases the TIME_WAIT socket reference and jumps to discard_it on PSP policy failure in both tcp_v4_rcv and tcp_v6_rcv. The corrective commits are available in the upstream stable tree: Kernel Git Commit 2c1931a, Kernel Git Commit 374742a, and Kernel Git Commit e666af5. Consult your distribution's security tracker for backported package versions.
Workarounds
- Disable PSP policy enforcement on affected TCP listeners until the kernel patch can be applied, if operationally acceptable.
- Restrict inbound TCP traffic to trusted sources using edge firewall rules to reduce exposure to policy-triggering segments.
- Reduce the TIME_WAIT lifetime with net.ipv4.tcp_fin_timeout tuning to limit the window during which leaks accumulate.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
