CVE-2026-68386

A flaw was found in the Linux kernel. A local attacker with BPF program capabilities could exploit a vulnerability in the BPF sockmap feature. This occurs when a BPF program increments the reference count of an unbound UDP socket, and the socket is subsequently bound. This sequence of events causes the bpf_sk_release() function to skip decrementing the reference count, leading to a memory leak.

This vulnerability is rated as Low severity because exploitation requires local access with elevated BPF privileges to load and interact with socket maps, and the resulting impact is confined to a memory leak causing potential resource exhaustion. In default Red Hat Enterprise Linux environments, unprivileged access to the extended Berkeley Packet Filter (eBPF) subsystem is disabled, preventing unauthorized users from creating or manipulating socket maps. Consequently, only administrative users or processes with explicit BPF capabilities can encounter this condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.