Use-after-free in Linux kernel - CVE-2026-74589

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.

The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.

Affected software

How to mitigate CVE-2026-74589

External References

• https://git.kernel.org/stable/c/1cec526cf0a2227395f2c2f4b671cb052ff0b00e
• https://git.kernel.org/stable/c/41b7da0cb72ca5aa1e62b68dab323d0791fc6bdf
• https://git.kernel.org/stable/c/4c9d9aa809c261dc0490a0e19d675f7e8e4c85bf
• https://git.kernel.org/stable/c/90a19b0894ba79a699b48cf44421b36fbd566e99
• https://git.kernel.org/stable/c/9b4fbc371a6ecf1b4e43b5a629015cc0830d8de3
• https://git.kernel.org/stable/c/a14e4ef1d90c3418f01b3b6b8fd3a40a0a208a10
• https://git.kernel.org/stable/c/a76624733730e541e4955fdecf506af2f6b20558
• https://git.kernel.org/stable/c/d192cff2a37d59206dabe6ec2e60ceac6271f274

Related Security Bulletins

• Use-after-free in Linux kernel ipv4
• Debian update for linux