CVE-2026-22977: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22977 is a Linux kernel vulnerability in the network socket error queue handling that causes a kernel panic (denial of service) when CONFIG_HARDENED_USERCOPY is enabled. The flaw exists in sock_recv_errqueue() due to skbuff_fclone_cache lacking a usercopy whitelist region for the sk_buff.cb field, unlike skbuff_head_cache. It affects Linux kernel versions 4.16 through 5.10.247, 5.11 through 5.15.197, 5.16 through 6.1.160, 6.2 through 6.6.120, 6.7 through 6.12.65, 6.13 through 6.18.5, and 6.19-rc1 through 6.19-rc4. It was disclosed on January 21, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is that skbuff_fclone_cache (used by alloc_skb_fclone() in TCP) was created without defining a usercopy whitelist region for the cb[] field, classified under CWE-489 (Active Debug Code) and CWE-476. When a TCP socket buffer (skb) is allocated from skbuff_fclone_cache, cloned via skb_clone(), queued to sk_error_queue for timestamp reporting, and then read by userspace via recvmsg(MSG_ERRQUEUE), the call chain sock_recv_errqueue() → put_cmsg() attempts to copy serr->ee from skb->cb to userspace. The hardened usercopy mechanism's __check_heap_object() detects that the source object (skbuff_fclone_cache, offset 296, size 16) has no usercopy whitelist and triggers a BUG() at mm/usercopy.c:102, crashing the kernel. The fix uses a local stack variable as a bounce buffer to bypass the hardened usercopy check (Red Hat Bugzilla, Kernel Patch).

Successful exploitation results in a kernel panic, causing a complete denial of service on the affected system. The vulnerability is limited to availability impact — there is no confidentiality or integrity compromise. A local authenticated attacker with low privileges can crash the kernel by triggering recvmsg(MSG_ERRQUEUE) on a TLS/TCP socket, making the system unavailable until rebooted. The impact is confined to systems where CONFIG_HARDENED_USERCOPY is enabled in the kernel configuration (Red Hat CVE, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and is only possible on systems with CONFIG_HARDENED_USERCOPY enabled, which limits the attack surface (Red Hat CVE).

1. Identify a vulnerable target: Confirm the target system runs a vulnerable Linux kernel version (4.16–5.10.247, 5.11–5.15.197, 5.16–6.1.160, 6.2–6.6.120, 6.7–6.12.65, 6.13–6.18.5, or 6.19-rc1 through rc4) with CONFIG_HARDENED_USERCOPY=y enabled (check via grep CONFIG_HARDENED_USERCOPY /boot/config-$(uname -r)).
2. Obtain local access: Gain a local shell with at least low-privilege user access on the target system.
3. Create a TLS/TCP socket: Open a TCP socket and enable TLS on it, or use any socket path that causes alloc_skb_fclone() to allocate an skb from skbuff_fclone_cache.
4. Trigger error queue population: Perform network operations that cause the kernel to clone the skb and queue it to sk_error_queue (e.g., enable socket timestamping with SO_TIMESTAMPING and send/receive data).
5. Call recvmsg with MSG_ERRQUEUE: Issue a recvmsg() system call with the MSG_ERRQUEUE flag, causing sock_recv_errqueue() to call put_cmsg() to copy serr->ee from skb->cb to userspace, triggering the hardened usercopy BUG and kernel panic (Red Hat Bugzilla).

• Logs: Kernel log entries containing usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' followed by kernel BUG at mm/usercopy.c:102!
• Logs: Kernel oops messages referencing usercopy_abort, __check_heap_object, put_cmsg, sock_recv_errqueue, and tls_sw_recvmsg in the call trace
• Logs: System crash/reboot events with kernel panic messages in /var/log/kern.log or dmesg output showing Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
• Process: Processes named poc_put_cmsg or similar test utilities making recvmsg(MSG_ERRQUEUE) calls on TLS sockets immediately before a system crash (Red Hat Bugzilla)

Apply kernel updates to the appropriate stable branch: Linux 5.10.248+, 5.15.198+, 6.1.161+, 6.6.121+, 6.12.66+, or 6.18.6+. Patches have been committed across multiple stable branches (commits: 005671c, 2a71a1a, 582a5e9, 88dd6be, 8c6901a, c655d21, e00b169). As a temporary workaround if patching is not immediately possible, disabling CONFIG_HARDENED_USERCOPY in the kernel configuration will prevent the crash, though this reduces kernel security hardening. Distributions including Ubuntu (USN-8278-1, USN-8289-1, USN-8296-1), Amazon Linux 2, Oracle Enterprise Linux, and Microsoft CBL-Mariner have released updated kernel packages (Red Hat CVE, Kernel Patch, Ubuntu USN-8278).

Red Hat tracked the issue as a medium-severity bug (Bugzilla #2431602) and published a CVE advisory. Microsoft also acknowledged the vulnerability in their Security Response Center update guide for CBL-Mariner. The vulnerability received routine coverage from Linux security aggregators including linuxsecurity.com and pro-linux.de, and was noted in Yocto Project security mailing lists. No significant researcher commentary or social media discussion beyond standard CVE tracking was observed (Red Hat CVE, Microsoft MSRC).