CVE-2026-74589

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the bpf sockmap component. The function tcp bpf send verdict() copies a pointer to psock->sk redir while holding the source socket lock but fails to take a reference for the local copy before releasing the lock around tcp bpf sendmsg redir(). In a race condition involving multiple threads, one thread may release the cached reference while another thread still holds only the raw local pointer, leading to a situation where sock put() frees sk redir before it is dereferenced by the other thread. This was identified via KASAN as a slab-use-after-free in the tcp bpf sendmsg redir() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.