CVE-2026-68386: Linux Kernel Privilege Escalation Flaw

CVE-2026-68386 Overview

CVE-2026-68386 is a memory leak vulnerability in the Linux kernel's Berkeley Packet Filter (BPF) sockmap subsystem. The flaw affects the handling of unhashed User Datagram Protocol (UDP) sockets during sockmap updates. A BPF program can increment an unbound UDP socket's reference count through a lookup operation. When the socket subsequently transitions from unbound to bound, bpf_sk_release() skips the refcount decrement, leaking the socket structure.

The root cause is inconsistent behavior of sk_is_refcounted() across the socket lifecycle. Unbound UDP sockets return true, while bound sockets return false after SOCK_RCU_FREE is set.

Critical Impact
Local users with permission to load BPF programs can trigger repeated kernel memory leaks, leading to resource exhaustion and potential denial of service.

Affected Products

Linux kernel versions containing the sockmap UDP socket handling code prior to the referenced stable patches
Distributions shipping affected upstream kernel builds
Systems permitting BPF program loading with sockmap access

Discovery Timeline

2026-08-10 - CVE-2026-68386 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68386

Vulnerability Analysis

The vulnerability resides in the interaction between the BPF sockmap feature and UDP socket lifecycle management. sockmap accepts unbound UDP sockets for insertion. When a BPF program performs a lookup against a sockmap entry, the kernel increments the socket's reference count because sk_is_refcounted() returns true for unbound UDP sockets.

After binding, UDP sockets receive the SOCK_RCU_FREE flag. This changes the return value of sk_is_refcounted() to false. When bpf_sk_release() runs against the now-bound socket, it evaluates the current refcounted state and skips the decrement. The reference count remains permanently elevated, and the socket object is never freed.

The upstream fix rejects unhashed UDP sockets during sockmap updates rather than special-casing refcounted sockets. This effectively reverts prior behavior that allowed unbound UDP sockets into sockmap, with two exceptions: sock_map_sk_state_allowed() retains its fall-through return true, and the proto::unhash BPF handler is not reintroduced.

Root Cause

The root cause is a state-dependent asymmetry in reference counting logic. The SOCK_RCU_FREE flag toggles on bind(), changing how the release path evaluates the socket. Code paths that took a reference before the transition cannot correctly release it afterward, producing a memory leak [CWE-401].

Attack Vector

A local process with the ability to load BPF programs and manipulate sockmap structures can trigger the leak. The attacker creates a UDP socket, inserts it into a sockmap, invokes a BPF program that looks up the socket to increment its refcount, then binds the socket. Repeating this sequence exhausts kernel slab memory and can degrade or crash the host.

The leak is observable via kmemleak reports referencing sk_prot_alloc and inet_create in the allocation backtrace, as documented in the upstream commit message.

Detection Methods for CVE-2026-68386

Indicators of Compromise

Growing kernel slab allocations tied to UDP socket objects without corresponding close() activity
kmemleak reports referencing sk_prot_alloc, sk_alloc, inet_create, and __sys_socket in allocation backtraces
Unexplained increases in the sock_inode_cache or UDP-specific slabs visible in /proc/slabinfo
BPF programs of type BPF_PROG_TYPE_SK_SKB or BPF_PROG_TYPE_SK_MSG performing repeated bpf_sk_lookup_* calls against sockmap entries

Detection Strategies

Monitor kernel memory growth trends and correlate with BPF program load events audited via bpf() syscall telemetry
Enable CONFIG_DEBUG_KMEMLEAK on test systems to surface the exact allocation path described in the upstream commit
Audit BPF program bytecode for patterns that combine sockmap lookups with UDP socket manipulation

Monitoring Recommendations

Track bpf() syscall invocations with arguments BPF_MAP_TYPE_SOCKMAP and BPF_MAP_TYPE_SOCKHASH via auditd
Alert on sustained growth of UDP socket allocations without matching release events
Review kernel logs for slab allocation warnings and out-of-memory events on hosts running untrusted BPF workloads

How to Mitigate CVE-2026-68386

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 17b7ef6, 250474c, 66efd33, 7ffe529, and 8692655
Restrict CAP_BPF and CAP_NET_ADMIN to trusted administrative accounts only
Set kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF
Reboot hosts after patch installation to load the corrected sockmap logic

Patch Information

The fix is available in the Linux stable tree. See the upstream commits: Kernel Patch 17b7ef6, Kernel Patch 250474c, Kernel Patch 66efd33, Kernel Patch 7ffe529, and Kernel Patch 8692655. The patches reject unhashed UDP sockets during sockmap updates, eliminating the refcount asymmetry.

Workarounds

Disable unprivileged BPF program loading through the kernel.unprivileged_bpf_disabled sysctl
Remove or restrict use of BPF_MAP_TYPE_SOCKMAP and BPF_MAP_TYPE_SOCKHASH in workloads that do not require UDP support
Isolate untrusted workloads that require BPF into short-lived containers or virtual machines to bound the impact of leaked memory

bash

# Configuration example
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/99-bpf-hardening.conf
sysctl -p /etc/sysctl.d/99-bpf-hardening.conf