Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98925— bpf, sockmap: Fix self-redirect copied_seq double-counting

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： bpf, sockmap：修复 self-redirect 场景中 copied_seq 被重复计数的问题 当一个 BPF 程序将数据包（skb）重定向回同一个 socket（即使用 标志的自重定向，self-redirect）时， 会调用 ，该函数会推进 。然而，随后该 skb 会被送入 socket 的 psock 入站队列，并由 稍后读取；而 也会通过 会计路径再次推进 。这种重复计数导致 的推进量变为实际数据长度的两倍，从而触发以下警告： 修复方案： 在 函数开

AI Predicted 5.5 Difficulty: Moderate

Possible ATT&CK Techniques 2 AI

T1562.007 T1562.006

Affected Version Matrix 17

VendorProduct Version RangeStatus
Linux Linux fe735073a50eaa71aceb2e990827fe26f33cddd6< cf9aefb26a071cb8b6fdd761c27e022a1184946d affected
e5c6de5fa025882babf89cecbed80acf49b987fa< dc98def81e3c629e25fcdd5753b1db93aab27ce9 affected
e5c6de5fa025882babf89cecbed80acf49b987fa< ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa affected
e5c6de5fa025882babf89cecbed80acf49b987fa< ae1ffd04e98beefbe5d83335d506b0bcd5c2a6b3 affected
e5c6de5fa025882babf89cecbed80acf49b987fa< 88942054191185c6f8bea5568cbb5614d1e99af9 affected
e5c6de5fa025882babf89cecbed80acf49b987fa< 490a83d6386eec1d29f470c8d7331677fb46c3b7 affected
f9b4a0b537be7a6e5f002ca64b09dcca9c14e6ed affected
6.1.32< 6.1.189 affected
… +9 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98925

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf, sockmap: Fix self-redirect copied_seq double-counting
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \ rcvnxt BF2E806, fl 0 WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640 Call Trace: tcp_recvmsg+0x10a/0x500 sock_recvmsg+0x168/0x1d0 __sys_recvfrom+0x19a/0x2a0 __x64_sys_recvfrom+0xe4/0x1f0 do_syscall_64+0xf7/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806 WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0 Call Trace: tcp_recvmsg_locked+0x8d1/0x2640 tcp_recvmsg+0x10a/0x500 sock_recvmsg+0x168/0x1d0 __sys_recvfrom+0x19a/0x2a0 __x64_sys_recvfrom+0xe4/0x1f0 do_syscall_64+0xf7/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by converting self-redirect verdict to __SK_PASS at the beginning of sk_psock_verdict_apply(). This bypasses the __SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting the __SK_PASS path queue the skb to the psock ingress queue. The data is then read via tcp_bpf_recvmsg_parser(), which advances copied_seq exactly once through copied_from_self. Cross-socket redirects continue through __SK_REDIRECT with sk_psock_eat_skb() unchanged.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux fe735073a50eaa71aceb2e990827fe26f33cddd6 ~ cf9aefb26a071cb8b6fdd761c27e022a1184946d -
Linux Linux 6.4 -

II. Public POCs for CVE-2026-98925

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98925

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98925 (5)

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98944 7.8 HIGH HID: steam: Refactor registration
CVE-2026-99050 7.8 HIGH gpio: mpsse: fix race when arming the IRQ poll worker
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name
CVE-2026-98945 7.8 HIGH HID: steam: Rearrange teardown sequence
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections

Showing top 20 of 218 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-98925

No comments yet

Leave a comment