[SRU][F][PATCH 0/1] CVE-2026-68399

[Alex Shi]

[ Impact ]

If socket cloning bails out after sock_copy(), the cloned socket can retain
the parent's BPF local storage pointer. When the clone is subsequently freed,
its destruction path can free storage belonging to the parent socket, causing
a use-after-free and possible kernel memory corruption. This affects systems
using BPF socket local storage.

CVE: CVE-2026-68399

[ Fix ]

For Focal, clear sk_bpf_storage immediately after sock_copy() in
sk_clone_lock(), and remove the redundant initialization from
bpf_sk_storage_clone(). The patch is adapted to Focal's older function
layout and RCU locking context.

[ Test Case ]

The patch was checked with checkpatch.pl and built on cbd. Kernel can boot in
VM.

[ Regression Potential ]

No

Alex Shi (1):
  bpf: Fix UAF in sock clone early bailouts

 net/core/bpf_sk_storage.c | 2 --
 net/core/sock.c           | 3 +++
 2 files changed, 3 insertions(+), 2 deletions(-)

-- 
2.53.0