CVE-2026-74714

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the Linux kernel within the bpf iter tcp established batch() function. The problem occurs because the function uses sock hold() while holding a bucket lock, incorrectly assuming that the lock ensures the socket reference count (sk refcnt) is greater than zero. However, for request sock, the reqsk queue hash req() function publishes the socket to the ehash chain and releases the lock before setting the reference count (rsk refcnt) to 3.

This creates a race condition where a concurrent process calling bpf iter tcp established batch() may perform an addition on a zero reference count. When the publishing CPU subsequently calls refcount set(), it overwrites the count, causing the socket to have one fewer reference than required. Consequently, when the last legitimate owner releases its reference, the reqsk is freed while still reachable, leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.