CVE-2026-68386 (GCVE-0-2026-68386)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:04 – Updated: 2026-08-19 16:34
VLAI
Title
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false. Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak. unreferenced object 0xffff88810bc2eb40 (size 1984): comm "test_progs", pid 2451, jiffies 4295320596 hex dump (first 32 bytes): 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................ 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace (crc bdee079d): kmem_cache_alloc_noprof+0x557/0x660 sk_prot_alloc+0x69/0x240 sk_alloc+0x30/0x460 inet_create+0x2ce/0xf80 __sock_create+0x25b/0x5c0 __sys_socket+0x119/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0xa1/0x5f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Instead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions: 1. sock_map_sk_state_allowed() maintains a fall-through `return true`. 2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage"), the proto::unhash BPF handler is not reintroduced. Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign").
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0c48eefae712c2fd91480346a07a1a9cd0f9470b , < 2271276ac5279d2d204be7739a1a28d4ef6cf608 (git)
Affected: 0c48eefae712c2fd91480346a07a1a9cd0f9470b , < 7ffe529e7127411806c8692fb1490f552c629dc2 (git)
Affected: 0c48eefae712c2fd91480346a07a1a9cd0f9470b , < 17b7ef6b86112a4e61cee1e9009a4b318e3225c5 (git)
Affected: 0c48eefae712c2fd91480346a07a1a9cd0f9470b , < 250474c69bc3fc48a5fc21d7c349f279caad947a (git)
Affected: 0c48eefae712c2fd91480346a07a1a9cd0f9470b , < 8692655da369961128658cf8539334b6a960ecb0 (git)
Affected: 0c48eefae712c2fd91480346a07a1a9cd0f9470b , < 66efd3368ae10d05e08fbe6425b50fdec7186ac7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.15
Unaffected: 0 , < 5.15 (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "8692655da369961128658cf8539334b6a960ecb0",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            },
            {
              "lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7",
              "status": "affected",
              "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/sock_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket\u0027s refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n  comm \"test_progs\", pid 2451, jiffies 4295320596\n  hex dump (first 32 bytes):\n    7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00  ................\n    02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............\n  backtrace (crc bdee079d):\n    kmem_cache_alloc_noprof+0x557/0x660\n    sk_prot_alloc+0x69/0x240\n    sk_alloc+0x30/0x460\n    inet_create+0x2ce/0xf80\n    __sock_create+0x25b/0x5c0\n    __sys_socket+0x119/0x1d0\n    __x64_sys_socket+0x72/0xd0\n    do_syscall_64+0xa1/0x5f0\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n   handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n   reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:34:40.363Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7"
        }
      ],
      "title": "bpf, sockmap: Reject unhashed UDP sockets on sockmap update",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68386",
    "datePublished": "2026-08-10T12:04:05.306Z",
    "dateReserved": "2026-07-30T09:28:09.388Z",
    "dateUpdated": "2026-08-19T16:34:40.363Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68386",
      "date": "2026-09-21",
      "epss": "0.00205",
      "percentile": "0.10895"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/sock_map.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2271276ac5279d2d204be7739a1a28d4ef6cf608",
                    "status": "affected",
                    "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7ffe529e7127411806c8692fb1490f552c629dc2",
                    "status": "affected",
                    "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "17b7ef6b86112a4e61cee1e9009a4b318e3225c5",
                    "status": "affected",
                    "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "250474c69bc3fc48a5fc21d7c349f279caad947a",
                    "status": "affected",
                    "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8692655da369961128658cf8539334b6a960ecb0",
                    "status": "affected",
                    "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "66efd3368ae10d05e08fbe6425b50fdec7186ac7",
                    "status": "affected",
                    "version": "0c48eefae712c2fd91480346a07a1a9cd0f9470b",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/sock_map.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.15"
                  },
                  {
                    "lessThan": "5.15",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.183",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.148",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Reject unhashed UDP sockets on sockmap update\n\nUDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means\nsk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.\n\nBecause sockmap accepts unbound UDP sockets, a BPF program can increment a\nsocket\u0027s refcount via lookup. If the socket is subsequently bound, the\ntransition from unbound to bound causes bpf_sk_release() to skip the\ndecrement of the refcount, causing a memory leak.\n\nunreferenced object 0xffff88810bc2eb40 (size 1984):\n  comm \"test_progs\", pid 2451, jiffies 4295320596\n  hex dump (first 32 bytes):\n    7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00  ................\n    02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............\n  backtrace (crc bdee079d):\n    kmem_cache_alloc_noprof+0x557/0x660\n    sk_prot_alloc+0x69/0x240\n    sk_alloc+0x30/0x460\n    inet_create+0x2ce/0xf80\n    __sock_create+0x25b/0x5c0\n    __sys_socket+0x119/0x1d0\n    __x64_sys_socket+0x72/0xd0\n    do_syscall_64+0xa1/0x5f0\n    entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nInstead of special-casing for refcounted sockets, reject unhashed UDP\nsockets during sockmap updates, as there is no benefit to supporting those.\nThis effectively reverts the commit under Fixes, with two exceptions:\n\n1. sock_map_sk_state_allowed() maintains a fall-through `return true`.\n2. In the spirit of commit b8b8315e39ff (\"bpf, sockmap: Remove unhash\n   handler for BPF sockmap usage\"), the proto::unhash BPF handler is not\n   reintroduced.\n\nHistorical note: this issue is related to commit 67312adc96b5 (\"bpf: reject\nunhashed sockets in bpf_sk_assign\")."
          }
        ],
        "id": "CVE-2026-68386",
        "lastModified": "2026-08-19T17:20:47.260",
        "metrics": {},
        "published": "2026-08-10T13:20:31.823",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2271276ac5279d2d204be7739a1a28d4ef6cf608"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-11T13:30:05+00:00",
      "cve": "CVE-2026-68386",
      "id": "CVE-2026-68386",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf, sockmap: Reject unhashed UDP sockets on sockmap update",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68386.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:31:02Z",
      "cve": "CVE-2026-68386",
      "id": "CVE-2026-68386",
      "initial_release_date": "2026-08-12T16:22:18Z",
      "product_status:known_affected": "538",
      "product_status:known_not_affected": "193",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68386",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68386.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.