APPLIED: [SRU][J/N][PATCH 0/1] CVE-2026-68399

[Stefan Bader]

On 11/09/2026 05:34, Alex Shi via kernel-team wrote:
> [ Impact ]
> 
> If socket cloning bails out after sock_copy(), the cloned socket can retain
> the parent's BPF local storage pointer. When the clone is subsequently freed,
> its destruction path can free storage belonging to the parent socket, causing
> a use-after-free and possible kernel memory corruption. This affects systems
> using BPF socket local storage.
> 
> CVE: CVE-2026-68399
> 
> [ Fix ]
> 
> For Noble/Jammy, clear sk_bpf_storage immediately after sock_copy() in
> sk_clone_lock(), and remove the redundant initialization from
> bpf_sk_storage_clone(). The patch is adapted to their older function layout
> and RCU locking context.
> 
> [ Test Case ]
> 
> The patch was checked with checkpatch.pl and built on cbd. Kernel can boot in
> vm.
> 
> [ Regression Potential ]
> 
> No
> 
> Alex Shi (1):
>    bpf: Fix UAF in sock clone early bailouts
> 
>   net/core/bpf_sk_storage.c | 2 --
>   net/core/sock.c           | 3 +++
>   2 files changed, 3 insertions(+), 2 deletions(-)
> 

Applied to noble,jammy:linux/master-next. Thanks.

-Stefan
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260917/8bdd94e3/attachment-0001.sig>