CVE-2026-64025

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bpf, skmsg component where a race condition occurs between the verdict sk data ready and ktls rx. When a socket is inserted into a sockmap using BPF SK SKB VERDICT before TLS RX is configured, the sk psock verdict data ready() function lacks a necessary guard. This allows tcp read skb() to drain the sk receive queue via skb unlink() without advancing the copied seq. Consequently, tls strp msg load() may operate on an empty queue, leading to a use-after-free condition when tls decrypt sg() attempts to process a potentially freed skb (socket buffer).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.