CVE-2026-74268

A flaw was found in the Linux kernel. A race condition exists in the TCP (Transmission Control Protocol) component when handling child sockets. If a child socket's setup fails, it can inherit BPF (Berkeley Packet Filter) socket operation flags, leading to a situation where the system attempts to call a BPF function without the necessary socket lock. This can result in a kernel panic, causing a denial of service.

A moderate severity denial of service flaw exists in the Linux kernel's TCP implementation as shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt packages), Red Hat In-Vehicle OS 2, and the RHEL CoreOS-based nodes of OpenShift Container Platform 4 and 5. A child socket accepted from a listening socket inherits the listener's BPF sock_ops callback flags via sk_clone_lock(). If that child's setup fails in tcp_v4_syn_recv_sock() or tcp_v6_syn_recv_sock(), the socket is force-closed along a path where inet_csk_prepare_forced_close() drops the socket lock before tcp_done() runs. If the inherited BPF_SOCK_OPS_STATE_CB_FLAG is set, tcp_done() -> tcp_set_state() then invokes the BPF sock_ops callback without the lock held, tripping the sock_owned_by_me() assertion; the flaw can escalate to a kernel panic, resulting in a denial of service. Triggering the flaw requires a BPF sock_ops program using state callbacks to be attached to the listening socket, a privileged local configuration, and a failure of the child socket's setup during connection establishment. For this reason Red Hat rates the flaw as moderate (CVSS 5.5, local attack vector with privileges required, availability impact only); the CVE.org score of 9.8 Critical does not reflect these prerequisites and overstates the practical risk. Red Hat Enterprise Linux 7 (kernel and kernel-rt) is not affected because the vulnerable code is not present, and Red Hat Enterprise Linux 6 Extended Lifecycle Support is out of support scope. Fixes for the affected products are currently deferred, consistent with the moderate impact rating and the specific configuration required to trigger the flaw; the residual risk is limited to availability on systems where BPF sock_ops state callback programs are attached to listening sockets, with no confidentiality or integrity impact indicated.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.