CVE-2026-68399

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component, specifically within the socket cloning mechanism. When a new socket is created and its cloning process fails prematurely, the new socket's BPF local storage may incorrectly reference the parent socket's storage. This can lead to a Use-After-Free (UAF) vulnerability, where the parent socket's BPF local storage is deallocated while still in use. An attacker could potentially exploit this to cause a system crash (denial of service) or achieve arbitrary code execution.

This flaw is rated as Moderate severity because exploitation requires local access, elevated privileges to configure BPF socket storage, and specific, uncommon failure conditions during socket replication. In typical Red Hat Enterprise Linux environments, unprivileged users cannot load or attach BPF programs by default, significantly limiting exposure to trusted administrative processes. While triggering premature cleanup during socket cloning can corrupt parent socket memory and destabilize the kernel, the high prerequisite privileges and narrow execution window make remote or unauthorized exploitation infeasible.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.