CVE-2026-74714: Linux Kernel BPF TCP Use-After-Free Vulnerability

CVE-2026-74714 Overview

CVE-2026-74714 is a use-after-free vulnerability in the Linux kernel's BPF TCP iterator. The flaw resides in bpf_iter_tcp_established_batch(), which incorrectly assumes that holding the ehash bucket lock guarantees a non-zero socket reference count. This assumption fails for TCP_NEW_SYN_RECV request sockets, which are published into the ehash chain before rsk_refcnt is initialized. A concurrent BPF iterator can call sock_hold() on a request socket with a zero refcount, leading to reference count corruption and eventual use-after-free.

Critical Impact
A local attacker with permission to open a BPF TCP iterator can trigger memory corruption in kernel space, enabling privilege escalation or denial of service.

Affected Products

Linux kernel versions containing the BPF TCP iterator batch code path
Distributions shipping kernels prior to the fix commits referenced by upstream stable
Systems where unprivileged BPF or iter/tcp usage is permitted

Discovery Timeline

2026-08-22 - CVE-2026-74714 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74714

Vulnerability Analysis

The vulnerability is a race condition producing a use-after-free [CWE-416] in the kernel's BPF TCP iterator. When a new inbound TCP handshake arrives, tcp_conn_request() calls reqsk_queue_hash_req(), which inserts a TCP_NEW_SYN_RECV request socket into the established hash chain under the bucket lock. The lock is released before refcount_set(&req->rsk_refcnt, 3) initializes the reference count.

During this window, bpf_iter_tcp_established_batch() can acquire the same bucket lock and enumerate the newly published request socket. The iterator uses sock_hold(), which performs an unconditional increment. Incrementing a refcount of zero triggers refcount_warn_saturate and saturates the counter. When the publishing CPU subsequently runs refcount_set(), it clobbers the saturated value, silently discarding the iterator's stolen reference.

When the last legitimate owner releases its reference, the request socket is freed while the iterator still holds a dangling pointer. Subsequent access produces use-after-free behavior with attacker-influenced timing.

Root Cause

The root cause is an invalid locking assumption. Lockless readers such as __inet_lookup_established() correctly use refcount_inc_not_zero() to guard against sockets whose refcount has not yet been published. bpf_iter_tcp_established_batch() instead relied on the bucket lock to imply sk_refcnt > 0, which does not hold for request sockets during the publish window.

Attack Vector

Exploitation requires local access and the ability to open an iter/tcp BPF link. The reproducer described in the upstream commit uses tcp_syncookies=0, multiple threads performing connect()/close() against a local listener, and additional threads repeatedly reading the BPF iterator. The race is reachable in seconds under this workload. The vulnerability requires local privileges consistent with BPF iterator access and does not require user interaction.

No public proof-of-concept exploit is currently available beyond the reproducer described in the kernel commit message. See the upstream fix commit for the authoritative technical description.

Detection Methods for CVE-2026-74714

Indicators of Compromise

Kernel log entries containing refcount_t: addition on 0 or refcount_warn_saturate warnings originating from bpf_iter_tcp_established_batch.
Call traces referencing bpf_iter_tcp_batch, bpf_iter_tcp_seq_next, or bpf_seq_read alongside refcount warnings.
Unexpected kernel oops or panic events on hosts running BPF TCP iterators under high connection churn.

Detection Strategies

Monitor dmesg and journald for refcount_warn_saturate warnings tied to BPF or TCP subsystems.
Audit which processes hold bpf_link file descriptors for iter/tcp and correlate with unexpected users or containers.
Track BPF program loads with type BPF_PROG_TYPE_TRACING and attach target iter/tcp via bpftool prog show and audit logs.

Monitoring Recommendations

Ingest kernel ring buffer and audit logs into a centralized data lake for retention and correlation across the fleet.
Alert on kernel warnings involving reference count saturation, especially on hosts that do not normally load BPF iterators.
Baseline legitimate BPF iterator usage so that anomalous iter/tcp opens by non-observability processes surface for review.

How to Mitigate CVE-2026-74714

Immediate Actions Required

Apply the upstream stable kernel updates that incorporate the fix commits and reboot affected hosts.
Restrict CAP_BPF and CAP_SYS_ADMIN to trusted service accounts to limit who can open BPF iterators.
Set kernel.unprivileged_bpf_disabled=1 on systems that do not require unprivileged BPF.

Patch Information

Upstream Linux maintainers fixed the flaw by replacing sock_hold() with refcount_inc_not_zero() inside bpf_iter_tcp_established_batch(), skipping request sockets whose refcount has not yet been published. The iterator now determines batch completeness by whether the walk left any socket behind, rather than comparing end_sk to expected. Fixes are available in the following commits: 7d2b60a, 97e74d3, cc0295f8, cefcbbe2, ddbe966b, and e5fd3f51.

Workarounds

Disable unprivileged BPF via sysctl kernel.unprivileged_bpf_disabled=1 until patches are deployed.
Remove or restrict container capabilities that grant CAP_BPF and CAP_PERFMON to workloads that do not require them.
Avoid running third-party BPF TCP iterators on unpatched kernels serving high connection churn.

bash

# Disable unprivileged BPF at runtime and persist across reboots
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' > /etc/sysctl.d/90-bpf-hardening.conf

# Enumerate loaded BPF iterators to identify potential abuse surface
bpftool link show | grep -i iter
bpftool prog show | grep -i tracing