CVE-2026-74589: Linux Kernel BPF Sockmap Use-After-Free

CVE-2026-74589 Overview

CVE-2026-74589 is a use-after-free vulnerability in the Linux kernel's BPF sockmap subsystem. The flaw resides in tcp_bpf_send_verdict(), which copies a pointer to psock->sk_redir while holding the source socket lock but fails to acquire a reference on the local copy before releasing that lock. A concurrent sendmsg() on the same source socket can consume the cached verdict, drop the reference, and free the redirect socket while the first thread still holds a raw pointer.

Critical Impact
Local attackers can trigger a kernel use-after-free by racing concurrent sendmsg() calls against a sockmap-attached socket, enabling potential privilege escalation or kernel memory corruption.

Affected Products

Linux kernel with BPF sockmap support (CONFIG_BPF_SYSCALL and sockmap enabled)
TCP sockets attached to sockmap with BPF verdict programs
Multiple stable kernel branches referenced by the fixing commits

Discovery Timeline

2026-08-22 - CVE-2026-74589 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74589

Vulnerability Analysis

The defect is a classic reference-counting race in the sockmap send verdict path. sk_psock_msg_verdict() takes a socket reference for psock->sk_redir, representing the cached redirect target for the current verdict. tcp_bpf_send_verdict() reads that pointer into a local variable under the source socket lock, then drops the lock around the call to tcp_bpf_sendmsg_redir().

The local copy is not itself reference-counted. While the lock is released, another sendmsg() on the same source socket can execute, decrement apply_bytes to zero, clear psock->sk_redir, and invoke sock_put() on the cached socket. When the first thread resumes and dereferences its stale pointer inside tcp_bpf_sendmsg_redir(), the redirect socket may already be freed via RCU.

KASAN confirmed the pattern with a slab-use-after-free read at tcp_bpf_sendmsg_redir+0xf39/0x1020, with the freed object originating from inet_csk_clone_lock() and reclaimed through sk_psock_destroy().

Root Cause

The root cause is missing reference acquisition on a shared, lock-protected pointer before that lock is dropped. Ownership of psock->sk_redir is tied to the cached-verdict lifetime, but the unlocked consumer in tcp_bpf_send_verdict() treats its local copy as if it inherited that ownership. When apply_bytes reaches zero on a parallel path, the cached reference is released without coordination with in-flight consumers.

Attack Vector

Exploitation requires local access and the ability to create BPF sockmap programs or to interact with a socket attached to one. An attacker issues concurrent sendmsg() calls on a source socket configured with a verdict program that redirects traffic and uses apply_bytes. Racing the two calls so one drains apply_bytes while the other is between release_sock() and tcp_bpf_sendmsg_redir() triggers the free. Successful exploitation can produce kernel memory corruption suitable for privilege escalation.

See the upstream fix in Kernel Commit a7662473 for the reference-taking correction.

Detection Methods for CVE-2026-74589

Indicators of Compromise

KASAN reports citing slab-use-after-free in tcp_bpf_sendmsg_redir with allocation traces through inet_csk_clone_lock() and frees through sk_psock_destroy().
Unexpected kernel oops or general protection faults in call stacks that include tcp_bpf_sendmsg, tcp_bpf_send_verdict, or tcp_bpf_sendmsg_redir.
Unprivileged processes loading BPF sockmap programs and issuing high-concurrency sendmsg() workloads against redirect targets.

Detection Strategies

Enable KASAN on test and canary kernels to surface the use-after-free before it is weaponized in production.
Audit bpf() syscall usage and sockmap program attachments via SOCKMAP_UPDATE operations, correlating with process identity and container boundaries.
Alert on kernel crash telemetry (kdump, pstore, journald kernel: entries) referencing the affected functions.

Monitoring Recommendations

Ship kernel logs and BPF syscall auditd events into a central data lake for retrospective hunting across hosts.
Track processes with CAP_BPF or CAP_SYS_ADMIN that create sockmap or sockhash maps, especially in shared or multi-tenant environments.
Monitor for repeated segmentation faults or reboots on hosts running unpatched kernels with sockmap-enabled workloads.

How to Mitigate CVE-2026-74589

Immediate Actions Required

Apply the upstream stable kernel updates that include the fix, then reboot affected hosts to activate the patched kernel.
Inventory hosts running BPF sockmap programs and prioritize patching for multi-tenant nodes, container hosts, and Kubernetes workers.
Restrict bpf() syscall access to trusted users by enforcing kernel.unprivileged_bpf_disabled=1 where operational needs allow.

Patch Information

The fix takes a temporary socket reference on the local sk_redir copy while the source socket lock still protects psock->sk_redir, then drops it after tcp_bpf_sendmsg_redir() returns. Stable-tree backports are published across several branches in Kernel Commit 1cec526c, Kernel Commit 41b7da0c, Kernel Commit 4c9d9aa8, Kernel Commit 90a19b08, Kernel Commit 9b4fbc37, Kernel Commit a14e4ef1, Kernel Commit a7662473, and Kernel Commit d192cff2.

Workarounds

Disable unprivileged BPF via sysctl -w kernel.unprivileged_bpf_disabled=1 and persist the setting in /etc/sysctl.d/.
Remove or detach BPF sockmap verdict programs that rely on apply_bytes redirection until the patched kernel is deployed.
Constrain container capabilities so workloads cannot obtain CAP_BPF, CAP_NET_ADMIN, or CAP_SYS_ADMIN unnecessarily.

bash

# Configuration example
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf

# Verify current kernel version after patching
uname -r