ACK: [SRU][J/N][PATCH 0/1] CVE-2026-68399

[Andrei Gherzan]

On 26/09/11 11:34AM, Alex Shi via kernel-team wrote:
> [ Impact ]
> 
> If socket cloning bails out after sock_copy(), the cloned socket can retain
> the parent's BPF local storage pointer. When the clone is subsequently freed,
> its destruction path can free storage belonging to the parent socket, causing
> a use-after-free and possible kernel memory corruption. This affects systems
> using BPF socket local storage.
> 
> CVE: CVE-2026-68399
> 
> [ Fix ]
> 
> For Noble/Jammy, clear sk_bpf_storage immediately after sock_copy() in
> sk_clone_lock(), and remove the redundant initialization from
> bpf_sk_storage_clone(). The patch is adapted to their older function layout
> and RCU locking context.
> 
> [ Test Case ]
> 
> The patch was checked with checkpatch.pl and built on cbd. Kernel can boot in
> vm.
> 
> [ Regression Potential ]
> 
> No
> 
> Alex Shi (1):
>   bpf: Fix UAF in sock clone early bailouts
> 
>  net/core/bpf_sk_storage.c | 2 --
>  net/core/sock.c           | 3 +++
>  2 files changed, 3 insertions(+), 2 deletions(-)

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260916/be948bfd/attachment.sig>