CVE-2026-74714 - bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
Brief
CVE ID : CVE-2026-74714
Published : Aug. 22, 2026, 4:16 p. m.
- 4 hours, 54 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()
reqsk_queue_hash_req() publishes a TCP_NEW_SYN_RECV request_sock onto the ehash chain, drops the bucket lock, and only afterwards sets rsk_refcnt to 3.
Lockless readers such as __inet_lookup_established() handle this with refcount_inc_not_zero(), but bpf_iter_tcp_established_batch() uses plain sock_hold() while holding the bucket lock, on the assumption that the lock guarantees sk_refcnt 0. That assumption does not hold for request_sock: