In the Linux kernel, the following vulnerability has been resolved:
net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory
Fixes the below NULL pointer dereference:
[...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...]
The test scenario has the following flow:
thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait
While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1.
We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernel-livepatch-4.14.296-222.539Upgrade kernel-livepatch-5.10.155-138.670Upgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernelUpgrade python-perfUpgrade perfUpgrade kernel-toolsUpgrade kernel-livepatch-5.15.75-48.135Upgrade kernel-headersUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-aarch64 | May 20, 2026 | May 20, 2026 |
| Debian | — | Upgrade linux | Sep 22, 2025 | Sep 22, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernel | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Sep 18, 2025 |
| Ubuntu | — | Upgrade linux-hwe-5.4Upgrade linux-kvmUpgrade linux-nvidiaUpgrade linux-aws-fipsUpgrade linux-ibm-5.4Upgrade linux-iotUpgrade linux-awsUpgrade linux-gcpUpgrade linux-azure-5.4Upgrade linux-azure-fipsUpgrade linux-azure-4.15Upgrade linux-gcp-fipsUpgrade linux-azure-5.15Upgrade linux-gcp-5.15Upgrade linux-oracleUpgrade linux-gcp-5.4Upgrade linuxUpgrade linux-ibmUpgrade linux-raspi-5.4Upgrade linux-xilinx-zynqmpUpgrade linux-gcp-4.15Upgrade linux-azure-fde-5.15Upgrade linux-hweUpgrade linux-intel-iotg-5.15Upgrade linux-gkeopUpgrade linux-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-aws-5.4Upgrade linux-riscv-5.15Upgrade linux-oracle-5.4Upgrade linux-raspiUpgrade linux-oracle-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-aws-hweUpgrade linux-realtimeUpgrade linux-aws-5.15Upgrade linux-azureUpgrade linux-gkeUpgrade linux-bluefieldUpgrade linux-fipsUpgrade linux-intel-iotg | Sep 26, 2025 | Sep 18, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 18, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub