bpf: Fix UAF in sock clone early bailouts
CVE-2026-68399 · published 10 Aug 2026
How serious is it
- Severity: high, CVSS score 7.8 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2026-68399?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d to < f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01, 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d to < 24139461545e44442df9b80deace26b2eb3e103d, 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d to < 01f8a354497ba739f81b691b3702bc4c46500a4d, 6ac99e8f23d4b10258406ca0dd7bffca5f31da9d to < 14b49b5ab29979552c219a09e569b424fbbf4a6e
- Linux Linux: 5.2
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix UAF in sock clone early bailouts
Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage
before bailouts that access it"), sk_clone() performs an initial
shallow copy of the socket field ->sk_bpf_storage via sock_copy()
for the cloned socket newsk.
If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior
to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points
to the parent socket's BPF local storage. When newsk is subsequently
freed via sk_free(), the deallocation path (__sk_destruct() ->
bpf_sk_storage_free()) destroys the parent socket's BPF local storage,
leading to a use-after-free (UAF) on the parent socket.
Fix this by resetting newsk->sk_bpf_storage to NULL immediately after
sock_copy() in sk_clone(), and remove the now redundant initialization
from bpf_sk_storage_clone().
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01
- git.kernel.org/stable/c/24139461545e44442df9b80deace26b2eb3e103d
- git.kernel.org/stable/c/01f8a354497ba739f81b691b3702bc4c46500a4d
- git.kernel.org/stable/c/14b49b5ab29979552c219a09e569b424fbbf4a6e
- git.kernel.org/stable/c/7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON