In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Avoid using sk_socket after free when sending
The sk->sk_socket is not locked or referenced in backlog thread, and during the call to skb_send_sock(), there is a race condition with the release of sk_socket. All types of sockets(tcp/udp/unix/vsock) will be affected.
Race conditions: ''' CPU0 CPU1
backlog::skb_send_sock sendmsg_unlocked sock_sendmsg sock_sendmsg_nosec close(fd): ... ops->release() -> sock_map_close() sk_socket->ops = NULL free(socket) sock->ops->sendmsg ^ panic here '''
The ref of psock become 0 after sock_map_close() executed. ''' void sock_map_close() { ... if (likely(psock)) { ... // !! here we remove psock and the ref of psock become 0 sock_map_remove_links(sk, psock) psock = sk_psock_get(sk); if (unlikely(!psock)) goto no_psock; <=== Control jumps here via goto ... cancel_delayed_work_sync(&psock->work); <=== not executed sk_psock_put(sk, psock); ... } '''
Based on the fact that we already wait for the workqueue to finish in sock_map_close() if psock is held, we simply increase the psock reference count to avoid race conditions.
With this patch, if the backlog thread is running, sock_map_close() will wait for the backlog thread to complete and cancel all pending work.
If no backlog running, any pending work that hasn't started by then will fail when invoked by sk_psock_get(), as the psock reference count have been zeroed, and sk_psock_drop() will cancel all jobs via cancel_delayed_work_sync().
In summary, we require synchronization to coordinate the backlog thread and close() thread.
The panic I catched: ''' Workqueue: events sk_psock_backlog RIP: 0010:sock_sendmsg+0x21d/0x440 RAX: 0000000000000000 RBX: ffffc9000521fad8 RCX: 0000000000000001 ... Call Trace: <TASK> ? die_addr+0x40/0xa0 ? exc_general_protection+0x14c/0x230 ? asm_exc_general_protection+0x26/0x30 ? sock_sendmsg+0x21d/0x440 ? sock_sendmsg+0x3e0/0x440 ? __pfx_sock_sendmsg+0x10/0x10 __skb_send_sock+0x543/0xb70 sk_psock_backlog+0x247/0xb80 ... '''
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-develUpgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernelUpgrade python-perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade python-perfUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.15.186-128.192Upgrade perf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-modules-extraUpgrade perf6.12Upgrade kernelUpgrade kernel-libbpf-develUpgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-tools-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-toolsUpgrade perfUpgrade kernel-develUpgrade kernel-livepatch-6.1.144-170.251Upgrade kernel-livepatch-6.12.35-55.103Upgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel-modules-extra-commonUpgrade kernel6.12Upgrade kernel-libbpf-debuginfoUpgrade bpftool | Aug 5, 2025 | Jul 3, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 4, 2025 | Jul 4, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade bpftoolUpgrade python3-perfUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelists | Nov 12, 2025 | Oct 23, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-tools-libsUpgrade bpftoolUpgrade kernel-toolsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Oct 24, 2025 | Oct 23, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Sep 10, 2025 | Jul 3, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernelUpgrade kernel-rt | Jul 9, 2025 | Jul 3, 2025 |
| Suse | — | Upgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade kernel-64kb-optionalUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-exynosUpgrade kernel-64kb-develUpgrade reiserfs-kmp-azureUpgrade kernel-debugUpgrade kernel-default-livepatch-develUpgrade kernel-default-optionalUpgrade ocfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-default-vdsoUpgrade dtb-amdUpgrade dtb-lgUpgrade dtb-allwinnerUpgrade dtb-qcomUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade kernel-default-baseUpgrade kernel-debug-develUpgrade kernel-devel-rtUpgrade kernel-symsUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade dlm-kmp-rtUpgrade ocfs2-kmp-azureUpgrade dtb-renesasUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-extraUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade cluster-md-kmp-64kbUpgrade dtb-hisiliconUpgrade kernel-rt_debug-develUpgrade dtb-rockchipUpgrade kernel-azureUpgrade dtb-socionextUpgrade kernel-defaultUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-develUpgrade dtb-amazonUpgrade dtb-marvellUpgrade dtb-appleUpgrade dtb-amlogicUpgrade reiserfs-kmp-rtUpgrade kernel-syms-rtUpgrade kselftests-kmp-azureUpgrade dtb-apmUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade kernel-rtUpgrade kernel-macrosUpgrade dtb-freescaleUpgrade cluster-md-kmp-azureUpgrade kernel-default-extraUpgrade kernel-obs-qaUpgrade kernel-zfcpdumpUpgrade kernel-azure-extraUpgrade kernel-rt_debugUpgrade kernel-64kbUpgrade dtb-nvidiaUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-defaultUpgrade kernel-rt-extraUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade kernel-default-livepatchUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmallUpgrade kernel-docs-htmlUpgrade kernel-kvmsmall-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-docsUpgrade kernel-default-develUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-rt-vdsoUpgrade kernel-rt-livepatch-develUpgrade dtb-broadcomUpgrade reiserfs-kmp-64kbUpgrade ocfs2-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-syms-azure | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-aws-fips-5.15Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-5.15.0-1045-nvidia-tegra-rtUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-generic-64k-5.15Upgrade linux-image-5.15.0-156-lowlatency-64kUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-fipsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.14.0-1012-oemUpgrade linux-image-lowlatencyUpgrade linux-image-generic-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-azure-lts-22.04Upgrade linux-image-5.15.0-156-lowlatencyUpgrade linux-image-gcp-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-gcp-5.15Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-5.15.0-1089-gkeUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-5.15.0-1090-oracleUpgrade linux-image-nvidia-tegra-rtUpgrade linux-image-gke-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1034-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1092-gcpUpgrade linux-image-6.14.0-1014-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1092-aws-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-azure-6.14Upgrade linux-image-oem-6.14Upgrade linux-image-5.15.0-1087-nvidiaUpgrade linux-image-gkeopUpgrade linux-image-aws-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-lowlatency-6.8Upgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-aws-64k-5.15Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-5.15.0-1092-gcp-fipsUpgrade linux-image-5.15.0-1096-azureUpgrade linux-image-5.15.0-156-generic-64kUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1045-nvidia-tegraUpgrade linux-image-gcp-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1056-xilinx-zynqmpUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-ibm-5.15Upgrade linux-image-nvidiaUpgrade linux-image-aws-5.15Upgrade linux-image-oem-22.04aUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-5.15.0-1085-intel-iot-realtimeUpgrade linux-image-6.14.0-32-genericUpgrade linux-image-oracle-6.14Upgrade linux-image-5.15.0-1087-nvidia-lowlatencyUpgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-ibmUpgrade linux-image-gkeop-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-oem-24.04bUpgrade linux-image-oracleUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-lowlatency-5.15Upgrade linux-image-virtual-6.8Upgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-genericUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-6.14.0-1012-azureUpgrade linux-image-azure-fips-5.15Upgrade linux-image-6.8.0-1046-azureUpgrade linux-image-intel-iotg-5.15Upgrade linux-image-generic-64k-6.14Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.14.0-1013-oracle-64kUpgrade linux-image-5.15.0-1086-raspiUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-intelUpgrade linux-image-6.14.0-1013-aws-64kUpgrade linux-image-5.15.0-1096-azure-fipsUpgrade linux-image-raspi-5.15Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-5.15.0-1086-ibmUpgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-gke-64k-6.8Upgrade linux-image-generic-6.14Upgrade linux-image-fips-5.15Upgrade linux-image-aws-6.14Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-5.15.0-1092-realtimeUpgrade linux-image-5.15.0-1092-aws-fipsUpgrade linux-image-5.15.0-1088-kvmUpgrade linux-image-virtual-6.14Upgrade linux-image-raspiUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-nvidia-tegraUpgrade linux-image-gcp-64kUpgrade linux-image-azureUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-kvmUpgrade linux-image-oracle-5.15Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-raspi-6.8Upgrade linux-image-oem-24.04cUpgrade linux-image-gkeop-5.15Upgrade linux-image-gcp-6.14Upgrade linux-image-5.15.0-1092-awsUpgrade linux-image-fips-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-aws-6.8Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-5.15.0-1034-nvidia-tegra-igxUpgrade linux-image-realtime-5.15Upgrade linux-image-generic-64kUpgrade linux-image-azure-fips-6.8Upgrade linux-image-gke-6.8Upgrade linux-image-gkeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-24.04Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-64kUpgrade linux-image-raspi-6.14Upgrade linux-image-oracle-64k-6.14Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-ibm-classicUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oem-22.04dUpgrade linux-image-realtime-6.14Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-aws-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-nvidia-5.15Upgrade linux-image-6.14.0-1013-awsUpgrade linux-image-gcpUpgrade linux-image-5.15.0-156-generic-lpaeUpgrade linux-image-5.15.0-156-genericUpgrade linux-image-6.14.0-32-generic-64kUpgrade linux-image-virtualUpgrade linux-image-azure-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-generic-64k-6.8Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-virtual-5.15Upgrade linux-image-generic-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-realtime-6.8.1Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-azure-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-aws-64k-6.8Upgrade linux-image-azure-cvmUpgrade linux-image-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-6.14.0-1013-oracleUpgrade linux-image-azure-fipsUpgrade linux-image-intel-iotgUpgrade linux-image-aws-64k-6.14Upgrade linux-image-aws-lts-22.04Upgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-awsUpgrade linux-image-6.14.0-1016-gcp-64kUpgrade linux-image-6.14.0-1016-gcpUpgrade linux-image-6.14.0-1012-realtimeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-5.15.0-1087-intel-iotgUpgrade linux-image-kvm-5.15Upgrade linux-image-5.15.0-156-fipsUpgrade linux-image-5.15.0-1075-gkeopUpgrade linux-image-azure-5.15Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-oracle-6.8Upgrade linux-image-xilinxUpgrade linux-image-6.8.0-1046-azure-fips | Jul 7, 2025 | Jul 3, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 3, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub