Answer in brief
CVE-2026-68399 records a High severity (CVSS 7.8) vulnerability in bpf: Fix UAF in sock clone early bailouts. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <14b49b5ab29979552c219a09e569b424fbbf4a6e || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f | 14b49b5ab29979552c219a09e569b424fbbf4a6e, 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f |
| Linux/Linuxgeneric | 5.2 | Not reported |
| Linux/Linuxgeneric | >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <01f8a354497ba739f81b691b3702bc4c46500a4d || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <14b49b5ab29979552c219a09e569b424fbbf4a6e || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f | 01f8a354497ba739f81b691b3702bc4c46500a4d, 14b49b5ab29979552c219a09e569b424fbbf4a6e, 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f |
| Linux/Linuxgeneric | >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01 || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <24139461545e44442df9b80deace26b2eb3e103d || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <01f8a354497ba739f81b691b3702bc4c46500a4d || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <14b49b5ab29979552c219a09e569b424fbbf4a6e || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f | f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01, 24139461545e44442df9b80deace26b2eb3e103d, 01f8a354497ba739f81b691b3702bc4c46500a4d, 14b49b5ab29979552c219a09e569b424fbbf4a6e, 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f |
| Linux/Linuxgeneric | >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <ac855efc6bb216b262b672af68219e5b731f42a4 || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01 || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <24139461545e44442df9b80deace26b2eb3e103d || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <01f8a354497ba739f81b691b3702bc4c46500a4d || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <14b49b5ab29979552c219a09e569b424fbbf4a6e || >=6ac99e8f23d4b10258406ca0dd7bffca5f31da9d <7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f | ac855efc6bb216b262b672af68219e5b731f42a4, f6814814b3bdd6ecb6bc1fc53ba4e827e0185f01, 24139461545e44442df9b80deace26b2eb3e103d, 01f8a354497ba739f81b691b3702bc4c46500a4d, 14b49b5ab29979552c219a09e569b424fbbf4a6e, 7cbd0c4cebe4c9f678d15e6b9ba975e1155a107f |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 30, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk. If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket. Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().
Quoted source text, attributed separately from HOL analysis.