{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-64575", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-64575" ], "published": "2026-08-05T08:09:29Z", "summary": "bpf: tcp: fix double sock release on batch realloc", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: tcp: fix double sock release on batch realloc\n\nbpf_iter_tcp_batch() releases the current batch via\nbpf_iter_tcp_put_batch(), which drops the socket refs and rewrites\neach slot with the socket cookie, then grows the batch. cur_sk/end_sk\nare kept for bpf_iter_tcp_resume(), but on realloc failure the function\nreturns ERR_PTR() before resume runs, leaving cur_sk < end_sk over\nslots that now hold cookies rather than sock pointers.\nbpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and\ndereferences a cookie as a struct sock.\n\nEmpty the batch on the failure path so stop() does not release it\nagain. The sockets were already freed by the first\nbpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans\nthe bucket from the start instead of skipping it. The sibling\nGFP_NOWAIT failure path still holds real socket references and is left\nfor stop() to release.\n\n BUG: KASAN: null-ptr-deref in __sock_gen_cookie\n Read of size 8 at addr 0000000000000059 by task exploit\n ...\n __sock_gen_cookie (net/core/sock_diag.c:28)\n bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918)\n bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270)\n bpf_seq_read (kernel/bpf/bpf_iter.c:205)\n vfs_read (fs/read_write.c:572)\n ksys_read (fs/read_write.c:716)\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n Kernel panic - not syncing: Fatal exception", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.42" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64575" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c842882e4c5d2818b858d6baf3fd10958c93f729" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/7a6a6d2a127866935f87b55b557bc89693065462" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f0c1810320b0dac228103fad7311e89532134d83" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9f27c4f0ae35b5390ce4f7a54d3501144e41a54d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/8a726e9585ffe7bfbfad2b5279277a00973970f3" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/980a813452754f8001704744e92f7aa697c53dd3" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-19T16:47:12Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - Reached only through local bpf() syscalls that load a BPF_TRACE_ITER TCP program, create an iterator fd, and read it; bpf_seq_read drives bpf_iter_tcp_batch/stop. Per guidance BPF subsystem bugs are Local, not network-reachable.\nAC:L - The attacker controls both prerequisites: creating more than INIT_BATCH_SZ TCP sockets in one hash bucket to force bpf_iter_tcp_put_batch-then-realloc, and inducing GFP_USER -ENOMEM (memory pressure/cgroup limits) so the failure path runs without races outside their control.\nPR:L - Loading BPF_PROG_TYPE_TRACING/BPF_TRACE_ITER requires CAP_BPF and CAP_PERFMON, which BPF tokens can delegate into a non-init user namespace; consistent with other BPF iterator CVEs this is Low rather than full init-namespace root.\nUI:N - The attacker loads their own TCP iterator program and triggers the bug by reading their iterator fd; no victim action such as mounting, opening a file, or interacting with the attacker is required.\nS:U - Impact is kernel memory corruption and panic within the same host kernel security authority; this is a standard local kernel bug, not a VM/hypervisor escape or IOMMU boundary bypass.\nC:H - stop() re-enters bpf_iter_tcp_put_batch and treats stored socket cookies as struct sock pointers, so sock_gen_cookie performs an out-of-bounds/wild kernel read; type-confused pointer dereference supports high confidentiality impact under the higher-severity rule.\nI:H - The same type confusion reaches sock_gen_put, which decrements sk_refcnt and may free through the forged pointer, yielding kernel memory corruption and a plausible control-flow/integrity primitive beyond a clean crash.\nA:H - The reported path is a KASAN null-ptr-deref in __sock_gen_cookie during bpf_iter_tcp_seq_stop that ends in kernel panic; the attacker can repeat the iterator read to deny host availability." } } }