CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved:

bpf: tcp: fix double sock release on batch realloc

bpfitertcpbatch() releases the current batch via bpfitertcpputbatch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk are kept for bpfitertcpresume(), but on realloc failure the function returns ERRPTR() before resume runs, leaving cursk < endsk over slots that now hold cookies rather than sock pointers. bpfitertcpseqstop() then calls bpfitertcpput_batch() again and dereferences a cookie as a struct sock.

Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpfitertcpputbatch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release.

BUG: KASAN: null-ptr-deref in __sockgencookie Read of size 8 at addr 0000000000000059 by task exploit ... __sockgencookie (net/core/sockdiag.c:28) bpfitertcpputbatch (net/ipv4/tcpipv4.c:2918) bpfitertcpseqstop (net/ipv4/tcpipv4.c:3270) bpfseqread (kernel/bpf/bpfiter.c:205) vfsread (fs/readwrite.c:572) ksysread (fs/readwrite.c:716) dosyscall64 entrySYSCALL64afterhwframe Kernel panic - not syncing: Fatal exception