CVE-2026-74268tcp: clear sock_ops cb flags before force-closing a child socket
- 9.8CriticalCVSS base score
- 0.71%Exploitation in 30 daysEPSS · top 46% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: clear sock_ops cb flags before force-closing a child socket A child socket inherits the listener's bpf_sock_ops_cb_flags via sk_clone_lock(). If its setup fails in tcp_v4_syn_recv_sock() / tcp_v6_syn_recv_sock(), the child is freed through put_and_exit, where inet_csk_prepare_forced_close() drops the socket lock and tcp_done() runs without it. If BPF_SOCK_OPS_STATE_CB_FLAG was inherited, tcp_done() -> tcp_set_state() calls tcp_call_bpf(), which expects the lock and trips sock_owned_by_me(): WARNING: include/net/sock.h:1799 at tcp_set_state+0x433/0x550 RIP: 0010:tcp_set_state+0x433/0x550 include/net/sock.h:1799 Call Trace: <IRQ> tcp_done+0xba/0x250 net/ipv4/tcp.c:5095 tcp_v4_syn_recv_sock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787 tcp_check_req+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926 tcp_v4_rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164 </IRQ> The child is freed before it is ever established, so it should run no sock_ops callback. Clear its cb flags in inet_csk_prepare_for_destroy_sock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->syn_recv_sock() failure path (dispose_child), which reaches tcp_done() on a child that was never established too.
Timeline
ID reserved
By Linux
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.71% · top 46% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < 5d5389b2c37ca00da61d1407618ebe15abae0c8b
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < 9f30ba9aa0270a18fdd1e6cd426c480c35f7de9d
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < 71e9c53220abd7f5a45aa4d5e5b420d3479f3a4f
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < 9fffa6465851a1910a6e9cb7272787dd615b26b1
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < fe23d56e9266d58ba5c380f1970118eedeee0b68
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < ce311bd2e36596f0aa2c92ca86fb3e019ac57eae
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < 8874dafc9099bc49c2e5ebba030f85d276421f92
- affected d44874910a26f3a8f81edf873a2473363f07f660 – < 990348e5bb457697c2f1f7f7b65154a3334d9d2b
- affected 4.16
- unaffected < 4.16
- unaffected 5.10.270 – ≤ 5.10.*
- unaffected 5.15.221 – ≤ 5.15.*
- unaffected 6.1.188 – ≤ 6.1.*
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/5d5389b2c37ca00da61d1407618ebe15abae0c8b (opens in a new tab)
- https://git.kernel.org/stable/c/9f30ba9aa0270a18fdd1e6cd426c480c35f7de9d (opens in a new tab)
- https://git.kernel.org/stable/c/71e9c53220abd7f5a45aa4d5e5b420d3479f3a4f (opens in a new tab)
- https://git.kernel.org/stable/c/9fffa6465851a1910a6e9cb7272787dd615b26b1 (opens in a new tab)
- https://git.kernel.org/stable/c/fe23d56e9266d58ba5c380f1970118eedeee0b68 (opens in a new tab)
- https://git.kernel.org/stable/c/ce311bd2e36596f0aa2c92ca86fb3e019ac57eae (opens in a new tab)
- https://git.kernel.org/stable/c/8874dafc9099bc49c2e5ebba030f85d276421f92 (opens in a new tab)
- https://git.kernel.org/stable/c/990348e5bb457697c2f1f7f7b65154a3334d9d2b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-59415 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-74268)Record last updated .