{"id":5409,"date":"2026-09-04T18:47:49","date_gmt":"2026-09-04T10:47:49","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68284"},"modified":"2026-09-04T18:47:49","modified_gmt":"2026-09-04T10:47:49","slug":"cve-2026-68284","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-68284","title":{"rendered":"CVE-2026-68284 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix cor"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()<\/p>\n<p>tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which<br \/>\ndrops and reacquires the socket lock.  Its error path tries to decide<br \/>\nwhether msg_tx names the local temporary message by comparing it with<br \/>\nthe current value of psock-&gt;cork.<\/p>\n<p>This comparison is unsafe when two threads send on the same socket:<\/p>\n<p>  Thread A                         Thread B<br \/>\n  msg_tx = psock-&gt;cork<br \/>\n  sk_msg_alloc() fails<br \/>\n  sk_stream_wait_memory()<br \/>\n    releases the socket lock      acquires the socket lock<br \/>\n                                  completes the cork<br \/>\n                                  psock-&gt;cork = NULL<br \/>\n                                  frees the cork<br \/>\n    reacquires the socket lock<br \/>\n  msg_tx != psock-&gt;cork<br \/>\n  sk_msg_free(msg_tx)<\/p>\n<p>The stale cork is therefore mistaken for the local temporary message<br \/>\nand freed again.  KASAN reported:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in sk_msg_free+0x49\/0x50<br \/>\n  Read of size 4 at addr ffff88810c908800 by task poc\/90<br \/>\n  Call Trace:<br \/>\n   sk_msg_free+0x49\/0x50<br \/>\n   tcp_bpf_sendmsg+0x14f5\/0x1cc0<br \/>\n   __sys_sendto+0x32c\/0x3a0<br \/>\n   __x64_sys_sendto+0xdb\/0x1b0<br \/>\n  Allocated by task 89:<br \/>\n   __kasan_kmalloc+0x8f\/0xa0<br \/>\n   tcp_bpf_sendmsg+0x16b3\/0x1cc0<br \/>\n  Freed by task 91:<br \/>\n   __kasan_slab_free+0x43\/0x70<br \/>\n   kfree+0x131\/0x3c0<br \/>\n   tcp_bpf_sendmsg+0xec3\/0x1cc0<\/p>\n<p>msg_tx can only name the stack-local tmp or the shared cork. Check for<br \/>\ntmp directly so a changed psock-&gt;cork cannot turn a shared message into<br \/>\nan apparent local one.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()<\/p>\n<p>tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which<br \/>\ndr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5409","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5409","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}