Use-After-Free Vulnerability in Linux Kernel Affecting Socket Cloning

CVE-2026-68399

What is CVE-2026-68399?

A use-after-free vulnerability was identified in the Linux kernel's socket cloning mechanism, specifically within the sk_clone() function. When a socket is cloned, an initial shallow copy of the socket's BPF local storage is performed. If the cloning process encounters an error and exits prematurely, the new socket retains a reference to the parent socket's BPF storage. This mismanagement can lead to the destruction of the parent socket's storage upon the new socket's deallocation, resulting in a use-after-free condition on the parent socket. A patch has been implemented to reset the new socket's BPF storage pointer to prevent this issue, enhancing overall system stability and security.

References