CVE-2026-74268

In the Linux kernel, the following vulnerability has been resolved:

tcp: clear sock_ops cb flags before force-closing a child socket

A child socket inherits the listener's bpfsockopscbflags via skclonelock(). If its setup fails in tcpv4synrecvsock() / tcpv6synrecvsock(), the child is freed through putandexit, where inetcskprepareforcedclose() drops the socket lock and tcp_done() runs without it.

If BPFSOCKOPSSTATECBFLAG was inherited, tcpdone() -> tcpsetstate() calls tcpcallbpf(), which expects the lock and trips sockownedby_me():

WARNING: include/net/sock.h:1799 at tcpsetstate+0x433/0x550 RIP: 0010:tcpsetstate+0x433/0x550 include/net/sock.h:1799 Call Trace: <IRQ> tcpdone+0xba/0x250 net/ipv4/tcp.c:5095 tcpv4synrecvsock+0x850/0xa50 net/ipv4/tcpipv4.c:1787 tcpcheckreq+0xf30/0x1360 net/ipv4/tcpminisocks.c:926 tcpv4rcv+0x1047/0x1b50 net/ipv4/tcpipv4.c:2164 </IRQ>

The child is freed before it is ever established, so it should run no sockops callback. Clear its cb flags in inetcskpreparefordestroysock(), the common point for the IPv4, IPv6 and chtls forced-close paths and for the MPTCP ->synrecvsock() failure path (disposechild), which reaches tcpdone() on a child that was never established too.