CVE-2026-43016

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) sockmap component. This vulnerability, a use-after-free, occurs due to improper management of AF_UNIX socket objects within the sk_psock_verdict_data_ready() function. A local attacker could exploit this issue by sending specially crafted messages, which may lead to privilege escalation or arbitrary code execution.

BPF sockmap verdict path could use sk->sk_socket after free during data-ready callbacks. Red Hat recommends patched kernels where BPF traffic steering on sockets is enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.