CVE-2026-43016
published 2026-05-01CVE-2026-43016: In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(). syzbot…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket
in sk_psock_verdict_data_ready(). [0]
In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is
called after dropping its unix_state_lock().
Although the sender socket holds the peer's refcount, it does not
prevent the peer's sock_orphan(), and the peer's sk_socket might
be freed after one RCU grace period.
Let's fetch the peer's sk->sk_socket and sk->sk_socket->ops under
RCU in sk_psock_verdict_data_ready().
[0]:
BUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278
Read of size 8 at addr ffff8880594da860 by task syz.4.1842/11013
CPU: 1 UID: 0 PID: 11013 Comm: syz.4.1842 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278
unix_stream_sendmsg+0x8a3/0xe80 net/unix/af_unix.c:2482
sock_sendmsg_nosec net/socket.c:721 [inline]
__sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x972/0x9f0 net/socket.c:2585
___sys_sendmsg+0x2a5/0x360 net/socket.c:2639
__sys_sendmsg net/socket.c:2671 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7facf899c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 c
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= c63829182c37c2d6d0608976d15fa61ebebe9e6b < 8d597e3e74027900ffa81b8ff47ab51999a3e110 | 8d597e3e74027900ffa81b8ff47ab51999a3e110 |
| linux | linux | >= c63829182c37c2d6d0608976d15fa61ebebe9e6b < 68187f18a89be4b6237d28ae1313b5adf76238c6 | 68187f18a89be4b6237d28ae1313b5adf76238c6 |
| linux | linux | >= c63829182c37c2d6d0608976d15fa61ebebe9e6b < 18861f87a043e78b1f901cae4237e755ed7ef095 | 18861f87a043e78b1f901cae4237e755ed7ef095 |
| linux | linux | >= c63829182c37c2d6d0608976d15fa61ebebe9e6b < af95bc39a83d82ae6ad253986335037256888b3f | af95bc39a83d82ae6ad253986335037256888b3f |
| linux | linux | >= c63829182c37c2d6d0608976d15fa61ebebe9e6b < ad8391d37f334ee73ba91926f8b4e4cf6d31ea04 | ad8391d37f334ee73ba91926f8b4e4cf6d31ea04 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.15 < 6.6.134 | 6.6.134 |
| linux | linux_kernel | >= 6.13 < 6.18.22 | 6.18.22 |
| linux | linux_kernel | >= 6.19 < 6.19.12 | 6.19.12 |
| linux | linux_kernel | >= 6.7 < 6.12.81 | 6.12.81 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready()
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-43016 [MEDIUM] CWE-825 kernel: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready()
kernel: bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready()
A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) sockmap component. This vulnerability, a use-after-free, occurs due to improper management of AF_UNIX socket objects within the `sk_psock_verdict_data_ready()` function. A local attacker could exploit this issue by sending specially crafted messages, which may lead to privilege escalation or arbitrary code execution.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel
GHSA
GHSA-52mq-7c45-jwp5: In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(
ghsa_unreviewed·2026-05-01
CVE-2026-43016 [HIGH] GHSA-52mq-7c45-jwp5: In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready(
In the Linux kernel, the following vulnerability has been resolved:
bpf: sockmap: Fix use-after-free of sk->sk_socket in sk_psock_verdict_data_ready().
syzbot reported use-after-free of AF_UNIX socket's sk->sk_socket
in sk_psock_verdict_data_ready(). [0]
In unix_stream_sendmsg(), the peer socket's ->sk_data_ready() is
called after dropping its unix_state_lock().
Although the sender socket holds the peer's refcount, it does not
prevent the peer's sock_orphan(), and the peer's sk_socket might
be freed after one RCU grace period.
Let's fetch the peer's sk->sk_socket and sk->sk_socket->ops under
RCU in sk_psock_verdict_data_ready().
[0]:
BUG: KASAN: slab-use-after-free in sk_psock_verdict_data_ready+0xec/0x590 net/core/skmsg.c:1278
Read of size 8 at addr ffff8880594da860 by task syz.4.18
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/18861f87a043e78b1f901cae4237e755ed7ef095https://git.kernel.org/stable/c/68187f18a89be4b6237d28ae1313b5adf76238c6https://git.kernel.org/stable/c/8d597e3e74027900ffa81b8ff47ab51999a3e110https://git.kernel.org/stable/c/ad8391d37f334ee73ba91926f8b4e4cf6d31ea04https://git.kernel.org/stable/c/af95bc39a83d82ae6ad253986335037256888b3f
2026-05-01
Published