{"api_version":"1","generated_at":"2026-08-23T02:41:08+00:00","cve":"CVE-2026-68399","urls":{"html":"https://cve.report/CVE-2026-68399","api":"https://cve.report/api/cve/CVE-2026-68399.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68399","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68399"},"summary":{"title":"bpf: Fix UAF in sock clone early bailouts","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field ->sk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points\nto the parent socket's BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() ->\nbpf_sk_storage_free()) destroys the parent socket's BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk->sk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone().","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:33","updated_at":"2026-08-17 06:17:48"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f","name":"https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e","name":"https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68399","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68399","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d 14b49b5ab29979552c219a09e569b424fbbf4a6e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.2","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.2 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68399","cve":"CVE-2026-68399","epss":"0.001290000","percentile":"0.029930000","score_date":"2026-08-17","updated_at":"2026-08-18 00:11:47"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/core/bpf_sk_storage.c","net/core/sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"14b49b5ab29979552c219a09e569b424fbbf4a6e","status":"affected","version":"6ac99e8f23d4b10258406ca0dd7bffca5f31da9d","versionType":"git"},{"lessThan":"7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f","status":"affected","version":"6ac99e8f23d4b10258406ca0dd7bffca5f31da9d","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/core/bpf_sk_storage.c","net/core/sock.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.2"},{"lessThan":"5.2","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"5.2","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field ->sk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points\nto the parent socket's BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() ->\nbpf_sk_storage_free()) destroys the parent socket's BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk->sk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone()."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable clone path and its early-bailout condition are driven through the BPF sk_storage subsystem and local socket setup (attaching sk_storage, attaching a socket filter, adjusting optmem_max). Per kernel guidance BPF is Local; a remote peer cannot control the bailout conditions.\nAC:L - An attacker who controls the local setup can deterministically force the early bailout by attaching a filter and lowering net.core.optmem_max below the filter size, exactly the sysctl-change scenario the code documents, making sk_filter_charge fail on every clone.\nPR:L - Reaching the bug requires attaching BPF sk_storage and manipulating socket/net settings; these capabilities (CAP_BPF/CAP_NET_ADMIN) can be reachable via user namespaces in some configurations, so the lower-privilege value is chosen per the higher-severity rule.\nUI:N - The clone is triggered by connection acceptance or association creation with no victim action; no user interaction is needed.\nS:U - The UAF corrupts kernel socket/BPF-storage objects within the kernel's own security authority; no crossing into a separate security scope (no VM/IOMMU boundary).\nC:H - The use-after-free lets the attacker reclaim the freed bpf_local_storage object with controlled contents, enabling disclosure of kernel memory; per guidance UAF is High.\nI:H - UAF on a live socket's BPF storage enables heap grooming and arbitrary-write primitives, giving control-flow hijack potential; per guidance UAF is High.\nA:H - Destroying the parent socket's still-referenced BPF local storage reliably causes memory corruption, oops, and kernel panic; per guidance any UAF/crash is High."}]}],"providerMetadata":{"dateUpdated":"2026-08-17T05:04:47.842Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e"},{"url":"https://git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f"}],"title":"bpf: Fix UAF in sock clone early bailouts","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68399","datePublished":"2026-08-10T12:04:18.837Z","dateReserved":"2026-07-30T09:28:09.389Z","dateUpdated":"2026-08-17T05:04:47.842Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:33","lastModifiedDate":"2026-08-17 06:17:48","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68399","Ordinal":"1","Title":"bpf: Fix UAF in sock clone early bailouts","CVE":"CVE-2026-68399","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68399","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix UAF in sock clone early bailouts\n\nSimilar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage\nbefore bailouts that access it\"), sk_clone() performs an initial\nshallow copy of the socket field ->sk_bpf_storage via sock_copy()\nfor the cloned socket newsk.\n\nIf sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior\nto calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points\nto the parent socket's BPF local storage. When newsk is subsequently\nfreed via sk_free(), the deallocation path (__sk_destruct() ->\nbpf_sk_storage_free()) destroys the parent socket's BPF local storage,\nleading to a use-after-free (UAF) on the parent socket.\n\nFix this by resetting newsk->sk_bpf_storage to NULL immediately after\nsock_copy() in sk_clone(), and remove the now redundant initialization\nfrom bpf_sk_storage_clone().","Type":"Description","Title":"bpf: Fix UAF in sock clone early bailouts"}]}}}