CVE-2026-64575

A flaw was found in the Linux kernel. A double release of socket resources can occur during batch reallocation in the BPF (Berkeley Packet Filter) TCP iterator. A local attacker could exploit this vulnerability to trigger a kernel panic. This leads to a system crash, resulting in a Denial of Service (DoS).

A moderate severity vulnerability was found in the Linux kernel's BPF TCP iterator. When bpf_iter_tcp_batch() fails to grow its batch after the current batch has already been released, the cur_sk/end_sk pointers are left referencing batch slots that now hold socket cookies instead of struct sock pointers. When bpf_iter_tcp_seq_stop() subsequently releases the batch again, a cookie value is dereferenced as a struct sock, which can crash the kernel. A local attacker able to trigger this reallocation failure path while reading a BPF TCP iterator could use this flaw to cause a kernel panic, resulting in a denial of service. Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernels are not affected because the vulnerable code, introduced upstream in Linux 6.17, is not present in the shipped kernel versions. The Red Hat severity of moderate (CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is lower than the upstream CVE record severity of important (7.8) because Red Hat assesses the impact as availability only, with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.