CVE-2026-74257

A flaw was found in the Linux kernel's sockmap feature. The udp_bpf_recvmsg() function, responsible for handling message reception, lacks proper serialization for sk_msg objects. This allows multiple threads to access and modify the same sk_msg object concurrently, resulting in a use-after-free vulnerability. A local attacker could exploit this to cause a denial of service.

Red Hat has evaluated this vulnerability as having a Moderate severity impact because exploitation requires local access and non-standard deployment of eBPF socket maps on UDP sockets, limiting the blast radius primarily to a local denial of service. Under default system installations, unprivileged user access to create or attach eBPF programs is restricted, which significantly narrows the exposure to privileged accounts or applications specifically leveraging sockmap redirection. Consequently, the primary risk involves system instability or kernel crashes triggered by concurrent message reads in environments with active UDP BPF policies, rather than remote compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.