CVE-2026-74589

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) sockmap feature. A use-after-free vulnerability exists in the sk_redir mechanism within the tcp_bpf_sendmsg_redir() function. This occurs when a socket reference is prematurely released while another thread still holds a raw pointer to it, leading to memory corruption. An attacker could potentially exploit this to cause a denial of service or other unspecified impacts.

A race in the BPF sockmap send verdict path can leave tcp_bpf_send_verdict with a raw sk_redir pointer after the source socket lock is dropped. Another sendmsg on the same source socket can consume the cached apply_bytes verdict, clear psock sk_redir, and release the cached socket reference while the first thread still uses the old pointer. KASAN reports a slab use-after-free in tcp_bpf_sendmsg_redir, so the bug is a real UAF rather than a simple NULL dereference or resource leak. For the CVSS the PR:L is used because reliable triggering requires local execution in a context that can reach the affected sockmap socket state, even if initial sockmap setup may require stronger privileges in many deployments. The issue is not directly network reachable because it is driven by local sendmsg activity and BPF sockmap state. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.