CVE-2026-68399

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF in sock clone early bailouts

Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpfstorage before bailouts that access it"), skclone() performs an initial shallow copy of the socket field ->skbpfstorage via sock_copy() for the cloned socket newsk.

If skclone() bails out early (e.g. if skfiltercharge() fails) prior to calling bpfskstorageclone(), newsk->skbpfstorage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__skdestruct() -> bpfskstoragefree()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket.

Fix this by resetting newsk->skbpfstorage to NULL immediately after sockcopy() in skclone(), and remove the now redundant initialization from bpfskstorage_clone().