CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix self-redirect copied seq double-counting

When a BPF stream verdict program redirects an skb back to the same socket (self-redirect with BPF F INGRESS), sk psock verdict apply() calls tcp eat skb() which advances tcp sk->copied seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp bpf recvmsg parser(), which also advances copied seq via the copied from self accounting path. This double-counting causes copied seq to advance by 2x the actual data length, triggering:

TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, rcvnxt BF2E806, fl 0 WARNING: net/ipv4/tcp.c:2745 at tcp recvmsg locked+0x72b/0x2640 Call Trace: tcp recvmsg+0x10a/0x500 sock recvmsg+0x168/0x1d0 sys recvfrom+0x19a/0x2a0 x64 sys recvfrom+0xe4/0x1f0 do syscall 64+0xf7/0x530 entry SYSCALL 64 after hwframe+0x77/0x7f

cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806 WARNING: net/ipv4/tcp.c:1609 at tcp cleanup rbuf+0xf2/0x1c0 Call Trace: tcp recvmsg locked+0x8d1/0x2640 tcp recvmsg+0x10a/0x500 sock recvmsg+0x168/0x1d0 sys recvfrom+0x19a/0x2a0 x64 sys recvfrom+0xe4/0x1f0 do syscall 64+0xf7/0x530 entry SYSCALL 64 after hwframe+0x77/0x7f

Fix this by converting self-redirect verdict to SK PASS at the beginning of sk psock verdict apply(). This bypasses the SK REDIRECT case entirely (which calls sk psock eat skb), letting the SK PASS path queue the skb to the psock ingress queue. The data is then read via tcp bpf recvmsg parser(), which advances copied seq exactly once through copied from self. Cross-socket redirects continue through SK REDIRECT with sk psock eat skb() unchanged.