Use-after-free in Linux kernel - CVE-2026-74714

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in bpf_iter_tcp_established_batch() when iterating over established TCP sockets. A local user can trigger concurrent socket activity and read an iter/tcp link to cause a denial of service.

This issue can occur when request_sock objects are visible in the ehash chain before their reference count is initialized, leading to a stale reachable socket being freed prematurely.

Affected software

How to mitigate CVE-2026-74714

External References

• https://git.kernel.org/stable/c/7d2b60a4bc0499f62ff8520af6309bbe170882fd
• https://git.kernel.org/stable/c/97e74d3e45d653c07c2d406fc530a9bbe3df8396
• https://git.kernel.org/stable/c/cc0295f89296ed351fc4b0b48fee887ba02c5d24
• https://git.kernel.org/stable/c/cefcbbe20846a45f9a7dae868f7ef1000953e2df
• https://git.kernel.org/stable/c/ddbe966b5d1fe212ada749bc3d0b410f1a7dea74
• https://git.kernel.org/stable/c/e5fd3f514e27db1f05fbd72ba615d74941e23c51

Related Security Bulletins

• Use-after-free in Linux kernel ipv4
• Debian update for linux