Vulnerability in Linux Kernel Affecting BPF and Sockmap Functionality

CVE-2026-68386

What is CVE-2026-68386?

A vulnerability in the Linux kernel allows unbound UDP sockets to be mishandled during sockmap updates. When these sockets are auto-bound, they remain in a state where the reference count is not properly decremented, leading to potential memory leaks. The issue arises from the ability of a BPF program to manipulate socket reference counts, which can result in unbound sockets not being correctly managed upon transition to a bound state. This oversight requires rejection of unhashed UDP sockets in sockmap updates to prevent memory management issues.

References