Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64575— bpf: tcp: fix double sock release on batch realloc

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.17版本存在安全漏洞，该漏洞源于bpf_iter_tcp_batch()在批次重新分配失败时未清空批次，导致bpf_iter_tcp_seq_stop()再次释放批次时将cookie当作sock指针解引用，可能造成空指针解引用，导致内核崩溃。

CVSS 7.8 · High EPSS 0.12% · P2

Affected Version Matrix 11

VendorProduct Version RangeStatus
Linux Linux 9794ac757a650dd594391192183c9caf939f8223< c842882e4c5d2818b858d6baf3fd10958c93f729 affected
1d7a82c1df5fc397eaca9c6b8c8f61aae9866ad4< 7a6a6d2a127866935f87b55b557bc89693065462 affected
36f955807ee4ede07e9410772f792e4cb4ec807b< f0c1810320b0dac228103fad7311e89532134d83 affected
cdec67a489d4fdae3e83e04fca0419136a83c4c2< 9f27c4f0ae35b5390ce4f7a54d3501144e41a54d affected
cdec67a489d4fdae3e83e04fca0419136a83c4c2< 8a726e9585ffe7bfbfad2b5279277a00973970f3 affected
cdec67a489d4fdae3e83e04fca0419136a83c4c2< 980a813452754f8001704744e92f7aa697c53dd3 affected
6.17 affected
< 6.17 unaffected
… +3 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64575

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf: tcp: fix double sock release on batch realloc
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers. bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr 0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 6.17版本存在安全漏洞，该漏洞源于bpf_iter_tcp_batch()在批次重新分配失败时未清空批次，导致bpf_iter_tcp_seq_stop()再次释放批次时将cookie当作sock指针解引用，可能造成空指针解引用，导致内核崩溃。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9794ac757a650dd594391192183c9caf939f8223 ~ c842882e4c5d2818b858d6baf3fd10958c93f729 -
Linux Linux 6.17 -

II. Public POCs for CVE-2026-64575

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64575

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64575 (5)

Same Patch Batch · Linux · 2026-08-05 · 17 CVEs total

CVE-2026-64566 9.8 CRITICAL xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
CVE-2026-64578 8.2 HIGH ksmbd: validate compound request size before reading StructureSize2
CVE-2026-64567 7.8 HIGH btrfs: reject free space cache with more entries than pages
CVE-2026-64568 7.8 HIGH wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
CVE-2026-64570 7.8 HIGH wifi: mac80211: fix fils_discovery double free on alloc failure
CVE-2026-64574 7.8 HIGH wifi: mac80211: tear down new links on vif update error path
CVE-2026-64580 7.8 HIGH xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
CVE-2026-64581 7.8 HIGH xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
CVE-2026-64582 7.8 HIGH RDMA/rxe: Fix a use-after-free problem in rxe_mmap
CVE-2026-64577 7.5 HIGH gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
CVE-2026-64576 7.1 HIGH nexthop: initialize extack in nh_res_bucket_migrate()
CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser
CVE-2026-64579 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64575

No comments yet

Leave a comment