CVE-2026-64575

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the BPF TCP implementation where a double socket release can occur during batch reallocation. The function bpf iter tcp batch() releases the current batch using bpf iter tcp put batch(), which drops socket references and replaces slots with socket cookies. If a reallocation failure occurs, the function returns an error before bpf iter tcp resume() runs, leaving the system in a state where cur sk is less than end sk over slots containing cookies instead of socket pointers. Subsequently, bpf iter tcp seq stop() calls bpf iter tcp put batch() again, leading to the dereferencing of a cookie as a struct sock, which can result in a null-pointer dereference in sock gen cookie() and cause a kernel panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.