NACK/Cmnt: [SRU][F][PATCH 0/1] CVE-2026-68399

[Edoardo Canepa]

Rejected for the following reasons:

Focal is ESM and submissions cannot be made trough this mailing list.

On 9/11/26 05:33, Alex Shi via kernel-team wrote:
> [ Impact ]
>
> If socket cloning bails out after sock_copy(), the cloned socket can retain
> the parent's BPF local storage pointer. When the clone is subsequently freed,
> its destruction path can free storage belonging to the parent socket, causing
> a use-after-free and possible kernel memory corruption. This affects systems
> using BPF socket local storage.
>
> CVE: CVE-2026-68399
>
> [ Fix ]
>
> For Focal, clear sk_bpf_storage immediately after sock_copy() in
> sk_clone_lock(), and remove the redundant initialization from
> bpf_sk_storage_clone(). The patch is adapted to Focal's older function
> layout and RCU locking context.
>
> [ Test Case ]
>
> The patch was checked with checkpatch.pl and built on cbd. Kernel can boot in
> VM.
>
> [ Regression Potential ]
>
> No
>
> Alex Shi (1):
>    bpf: Fix UAF in sock clone early bailouts
>
>   net/core/bpf_sk_storage.c | 2 --
>   net/core/sock.c           | 3 +++
>   2 files changed, 3 insertions(+), 2 deletions(-)
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/f806af9c/attachment.sig>