GHSA-F9JQ-9V6W-22V9
Vulnerability from github – Published: 2026-08-10 15:33 – Updated: 2026-08-14 00:31In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in sock clone early bailouts
Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.
If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket.
Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().
{
"affected": [],
"aliases": [
"CVE-2026-68399"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-10T13:20:33Z",
"severity": "HIGH"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe -\u003ebpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field -\u003esk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk-\u003esk_bpf_storage still points\nto the parent socket\u0027s BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() -\u003e\nbpf_sk_storage_free()) destroys the parent socket\u0027s BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk-\u003esk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone().",
"id": "GHSA-f9jq-9v6w-22v9",
"modified": "2026-08-14T00:31:58Z",
"published": "2026-08-10T15:33:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68399"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.