CVE-2026-74714

A flaw was found in the Linux kernel. A use-after-free vulnerability exists in the bpf_iter_tcp_established_batch() function. This flaw occurs because the sock_hold() function is used on a request_sock object whose reference count can be zero, leading to an incorrect reference count. A local attacker can trigger this by performing specific network operations while reading an iterator/TCP link, potentially leading to a denial of service.

A race in bpf_iter_tcp_established_batch can corrupt the reference count of a TCP_NEW_SYN_RECV request_sock because the iterator used sock_hold on a socket that can be visible in the ehash table with sk_refcnt equal to 0. The lost iterator reference can leave the request_sock one reference short and allow it to be freed while still reachable, creating a use after free condition. For the CVSS the PR:L is used because reliable triggering requires a local user or process that can read a BPF TCP iterator while creating TCP connection churn. The issue is not directly network reachable by packet traffic alone, although TCP connection activity is part of the race. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality and integrity impact due to use after free memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.