< Back

CVE-2026-68284

Updated on 10 Aug 2026

Severity

7.8 High severity

Details

CVSS score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected product
Affected component
Links: NIST CIRCL RHEL Ubuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()

tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_tx names the local temporary message by comparing it with the current value of psock->cork.

This comparison is unsafe when two threads send on the same socket:

Thread A Thread B msg_tx = psock->cork sk_msg_alloc() fails sk_stream_wait_memory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msg_tx != psock->cork sk_msg_free(msg_tx)

The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported:

BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: sk_msg_free+0x49/0x50 tcp_bpf_sendmsg+0x14f5/0x1cc0 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 89: __kasan_kmalloc+0x8f/0xa0 tcp_bpf_sendmsg+0x16b3/0x1cc0 Freed by task 91: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 tcp_bpf_sendmsg+0xec3/0x1cc0

msg_tx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one.

Details

Affected product:: AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , Debian 10 ELS , Debian 11 ELS , Oracle Linux 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 20.04 ELS
Affected packages:: linux @ 4.19.0 (+10 more)

Fixes

Operating system / Project

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system	Status	Covered kernels
Debian 12	Planned	—
Debian 13	Released	14 kernels 6.12.85-1 6.12.86-1 6.12.88-1 6.12.74-2 6.12.73-1 6.12.63-1 6.12.69-1 6.12.74-1 6.12.90-1 6.12.90-2 6.12.94-1 6.12.95-1 6.12.96-1 6.12.100-1
Oracle Linux 8 UEK 7	Released	112 kernels 5.15.0-102.110.5.el8uek 5.15.0-101.103.2.1.el8uek 5.15.0-8.91.4.1.el8uek 5.15.0-7.86.6.1.el8uek 5.15.0-2.52.3.el8uek 5.15.0-100.96.32.el8uek 5.15.0-5.76.5.1.el8uek 5.15.0-6.80.3.1.el8uek 5.15.0-3.60.5.1.el8uek 5.15.0-0.30.20.el8uek 5.15.0-1.43.4.1.el8uek 5.15.0-0.30.20.1.el8uek 5.15.0-1.43.4.2.el8uek 5.15.0-4.70.5.2.el8uek 5.15.0-104.119.4.2.el8uek 5.15.0-0.30.19.el8uek 5.15.0-105.125.6.2.el8uek 5.15.0-105.125.6.2.1.el8uek 5.15.0-105.125.6.2.2.el8uek 5.15.0-106.131.4.el8uek 5.15.0-200.131.27.el8uek 5.15.0-200.131.27.1.el8uek 5.15.0-201.135.6.el8uek 5.15.0-202.135.2.el8uek 5.15.0-102.110.5.1.el8uek 5.15.0-103.114.4.el8uek 5.15.0-203.146.5.1.el8uek 5.15.0-204.147.6.2.el8uek 5.15.0-204.147.6.3.el8uek 5.15.0-205.149.5.1.el8uek 5.15.0-205.149.5.4.el8uek 5.15.0-206.153.7.el8uek 5.15.0-206.153.7.1.el8uek 5.15.0-207.156.6.el8uek 5.15.0-208.159.3.el8uek 5.15.0-208.159.3.2.el8uek 5.15.0-209.161.7.el8uek 5.15.0-209.161.7.1.el8uek 5.15.0-209.161.7.2.el8uek 5.15.0-210.163.7.el8uek 5.15.0-300.163.18.el8uek 5.15.0-300.163.18.1.el8uek 5.15.0-300.163.18.1.1.el8uek 5.15.0-301.163.5.2.el8uek 5.15.0-302.167.6.el8uek 5.15.0-300.163.18.7.el8uek 5.15.0-302.167.6.1.el8uek 5.15.0-303.171.5.2.el8uek 5.15.0-303.171.5.2.1.el8uek 5.15.0-304.171.4.el8uek 5.15.0-304.171.4.1.el8uek 5.15.0-304.171.4.3.el8uek 5.15.0-303.171.5.2.2.el8uek 5.15.0-305.176.4.el8uek 5.15.0-306.177.4.el8uek 5.15.0-306.177.4.1.el8uek 5.15.0-307.178.5.el8uek 5.15.0-308.179.6.el8uek 5.15.0-308.179.6.2.el8uek 5.15.0-308.179.6.3.el8uek 5.15.0-309.180.4.el8uek 5.15.0-308.179.6.7.el8uek 5.15.0-309.180.4.2.el8uek 5.15.0-308.179.6.11.el8uek 5.15.0-310.184.5.2.el8uek 5.15.0-310.184.5.3.el8uek 5.15.0-311.185.9.el8uek 5.15.0-308.179.6.14.el8uek 5.15.0-312.187.5.el8uek 5.15.0-312.187.5.1.el8uek 5.15.0-312.187.5.2.el8uek 5.15.0-312.187.5.3.el8uek 5.15.0-308.179.6.16.el8uek 5.15.0-313.189.5.1.el8uek 5.15.0-313.189.5.2.el8uek 5.15.0-313.189.5.3.el8uek 5.15.0-314.193.5.3.el8uek 5.15.0-314.193.5.4.el8uek 5.15.0-314.193.5.5.el8uek 5.15.0-315.196.5.1.el8uek 5.15.0-315.196.5.2.el8uek 5.15.0-316.196.4.1.el8uek 5.15.0-316.196.4.2.el8uek 5.15.0-317.197.5.1.el8uek 5.15.0-317.197.5.2.el8uek 5.15.0-318.199.3.2.el8uek 5.15.0-318.199.3.2.1.el8uek 5.15.0-319.201.4.2.el8uek 5.15.0-319.201.4.3.el8uek 5.15.0-319.201.4.4.el8uek 5.15.0-319.201.4.6.el8uek 5.15.0-320.202.8.2.el8uek 5.15.0-320.202.8.3.el8uek 5.15.0-320.202.8.4.el8uek 5.15.0-320.202.8.5.el8uek 5.15.0-318.199.3.6.el8uek 5.15.0-321.202.5.el8uek 5.15.0-321.202.5.1.el8uek 5.15.0-321.202.5.2.el8uek 5.15.0-321.202.5.3.el8uek 5.15.0-322.203.3.2.el8uek 5.15.0-322.203.3.3.el8uek 5.15.0-322.203.3.4.el8uek 5.15.0-322.203.3.4.5.el8uek 5.15.0-308.179.6.18.el8uek 5.15.0-318.199.3.7.el8uek 5.15.0-322.203.3.5.el8uek 5.15.0-322.203.3.4.1.el8uek 5.15.0-323.211.3.3.el8uek 5.15.0-323.211.3.4.el8uek 5.15.0-308.179.6.19.el8uek 5.15.0-323.211.3.5.el8uek
Oracle Linux 9 UEK 7	Released	112 kernels 5.15.0-101.103.2.1.el9uek 5.15.0-8.91.4.1.el9uek 5.15.0-7.86.6.1.el9uek 5.15.0-5.76.5.1.el9uek 5.15.0-6.80.3.1.el9uek 5.15.0-3.60.5.1.el9uek 5.15.0-0.30.20.el9uek 5.15.0-100.96.32.el9uek 5.15.0-1.43.4.2.el9uek 5.15.0-2.52.3.el9uek 5.15.0-4.70.5.2.el9uek 5.15.0-1.43.4.1.el9uek 5.15.0-0.30.20.1.el9uek 5.15.0-102.110.5.el9uek 5.15.0-102.110.5.1.el9uek 5.15.0-103.114.4.el9uek 5.15.0-104.119.4.2.el9uek 5.15.0-0.30.19.el9uek 5.15.0-105.125.6.2.el9uek 5.15.0-105.125.6.2.1.el9uek 5.15.0-105.125.6.2.2.el9uek 5.15.0-106.131.4.el9uek 5.15.0-200.131.27.el9uek 5.15.0-200.131.27.1.el9uek 5.15.0-201.135.6.el9uek 5.15.0-202.135.2.el9uek 5.15.0-203.146.5.1.el9uek 5.15.0-204.147.6.2.el9uek 5.15.0-204.147.6.3.el9uek 5.15.0-205.149.5.1.el9uek 5.15.0-205.149.5.4.el9uek 5.15.0-206.153.7.el9uek 5.15.0-206.153.7.1.el9uek 5.15.0-207.156.6.el9uek 5.15.0-208.159.3.el9uek 5.15.0-208.159.3.2.el9uek 5.15.0-209.161.7.el9uek 5.15.0-209.161.7.1.el9uek 5.15.0-209.161.7.2.el9uek 5.15.0-210.163.7.el9uek 5.15.0-300.163.18.el9uek 5.15.0-300.163.18.1.el9uek 5.15.0-300.163.18.1.1.el9uek 5.15.0-301.163.5.2.el9uek 5.15.0-302.167.6.el9uek 5.15.0-300.163.18.7.el9uek 5.15.0-302.167.6.1.el9uek 5.15.0-303.171.5.2.el9uek 5.15.0-303.171.5.2.1.el9uek 5.15.0-304.171.4.el9uek 5.15.0-304.171.4.1.el9uek 5.15.0-304.171.4.3.el9uek 5.15.0-303.171.5.2.2.el9uek 5.15.0-305.176.4.el9uek 5.15.0-306.177.4.el9uek 5.15.0-306.177.4.1.el9uek 5.15.0-307.178.5.el9uek 5.15.0-308.179.6.el9uek 5.15.0-308.179.6.2.el9uek 5.15.0-308.179.6.3.el9uek 5.15.0-309.180.4.el9uek 5.15.0-308.179.6.7.el9uek 5.15.0-309.180.4.2.el9uek 5.15.0-308.179.6.11.el9uek 5.15.0-310.184.5.2.el9uek 5.15.0-310.184.5.3.el9uek 5.15.0-311.185.9.el9uek 5.15.0-308.179.6.14.el9uek 5.15.0-312.187.5.el9uek 5.15.0-312.187.5.1.el9uek 5.15.0-312.187.5.2.el9uek 5.15.0-312.187.5.3.el9uek 5.15.0-308.179.6.16.el9uek 5.15.0-313.189.5.1.el9uek 5.15.0-313.189.5.2.el9uek 5.15.0-313.189.5.3.el9uek 5.15.0-314.193.5.3.el9uek 5.15.0-314.193.5.4.el9uek 5.15.0-314.193.5.5.el9uek 5.15.0-315.196.5.1.el9uek 5.15.0-315.196.5.2.el9uek 5.15.0-316.196.4.1.el9uek 5.15.0-316.196.4.2.el9uek 5.15.0-317.197.5.1.el9uek 5.15.0-317.197.5.2.el9uek 5.15.0-318.199.3.2.el9uek 5.15.0-318.199.3.2.1.el9uek 5.15.0-319.201.4.2.el9uek 5.15.0-319.201.4.3.el9uek 5.15.0-319.201.4.4.el9uek 5.15.0-319.201.4.6.el9uek 5.15.0-320.202.8.2.el9uek 5.15.0-320.202.8.3.el9uek 5.15.0-320.202.8.4.el9uek 5.15.0-320.202.8.5.el9uek 5.15.0-318.199.3.6.el9uek 5.15.0-321.202.5.el9uek 5.15.0-321.202.5.1.el9uek 5.15.0-321.202.5.2.el9uek 5.15.0-321.202.5.3.el9uek 5.15.0-322.203.3.2.el9uek 5.15.0-322.203.3.3.el9uek 5.15.0-322.203.3.4.el9uek 5.15.0-322.203.3.4.5.el9uek 5.15.0-308.179.6.18.el9uek 5.15.0-318.199.3.7.el9uek 5.15.0-322.203.3.5.el9uek 5.15.0-322.203.3.4.1.el9uek 5.15.0-323.211.3.3.el9uek 5.15.0-323.211.3.4.el9uek 5.15.0-308.179.6.19.el9uek 5.15.0-323.211.3.5.el9uek
Ubuntu 22.04	Planned	—
Ubuntu 22.04 AWS	Planned	—
Ubuntu 22.04 Azure	Planned	—
Ubuntu 24.04	Planned	—
Ubuntu 24.04 AWS	Planned	—
Ubuntu 26.04	Will Not Fix	—

Release info

Copy page link

Open as a page

Advisory

CLSA-2025:1748945064

Operating system

CentOS 8.4 ELS

Published date

Nov 16, 2014

Project

Linux

Version

2.11.0-1~ubuntu16.04.1+tuxcare.els12

How to fix

Update command:

apt-get update
apt-get --only-upgrade install ansible*

Changelog

Insufficiently Random Passwords Leakage
Debian/patches/CVE-2020-10729.patch: Fix caching of Jinja2 expressions to prevent caching dynamic results
CVE-2020-10729

Updated packages

ansible_2.5.1+dfsg-1ubuntu0.1+tuxcare.els6_all.deb

CVE-2026-68284

Severity

Details

Overview

About vulnerability

Details

Statement

Fixes

Statement

KernelCare state

Unsubscribe