CVE-2026-64575: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64575 is a double socket release vulnerability in the Linux kernel's bpf_iter_tcp module that can lead to a null pointer dereference and kernel panic. It affects Linux kernel versions starting from 6.17 through unpatched 6.18.x and 7.1.x stable branches. The vulnerability was published on August 5, 2026, with patches available for stable branches. It carries a CVSS v3.1 base score of 7.8 (High) (Github Advisory, Red Hat Bugzilla).

The root cause is an expired pointer dereference (CWE-825) in bpf_iter_tcp_batch() within net/ipv4/tcp_ipv4.c. When the function attempts to grow the batch, it first calls bpf_iter_tcp_put_batch() to release socket references and overwrite each batch slot with a socket cookie (an integer value). If the subsequent memory reallocation fails, the function returns ERR_PTR() before bpf_iter_tcp_resume() runs, leaving cur_sk < end_sk pointing to slots that now contain cookies rather than valid struct sock pointers. When bpf_iter_tcp_seq_stop() subsequently calls bpf_iter_tcp_put_batch() again, it dereferences these cookie values as struct sock pointers, triggering a KASAN-detected null pointer dereference (BUG: KASAN: null-ptr-deref in __sock_gen_cookie) and a fatal kernel panic. Exploitation requires local access with low privileges and the ability to perform BPF iterator read operations on TCP sockets (Github Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel panic (fatal exception), resulting in a complete denial of service for the affected system. The CVSS scoring also rates confidentiality and integrity impacts as High, suggesting potential for memory disclosure or corruption in certain exploitation scenarios, though the primary demonstrated impact is system crash. The vulnerability is locally exploitable by a low-privileged user, making it a viable privilege escalation or disruption vector on multi-tenant or shared Linux systems (Github Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.154% (0.00154), placing it in the 2nd percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The vulnerability is detectable via Nessus plugin 332747 (Tenable).

1. Prerequisite: Obtain a local user account with low privileges on a vulnerable Linux system running kernel 6.17 or an unpatched 6.18.x/7.1.x version with BPF iterator support enabled.
2. Open a BPF TCP iterator: Use the bpf_iter interface to open a BPF sequence file for TCP sockets (e.g., via bpf_link_create with BPF_TRACE_ITER targeting TCP).
3. Trigger batch reallocation: Perform a read() syscall on the BPF iterator file descriptor under memory pressure conditions (e.g., with limited available memory) to cause bpf_iter_tcp_batch() to attempt a batch realloc that fails after releasing socket references.
4. Induce double release: The failed realloc leaves batch slots containing socket cookies instead of struct sock pointers. When the iterator's stop() callback (bpf_iter_tcp_seq_stop) fires, it calls bpf_iter_tcp_put_batch() again, dereferencing a cookie value as a struct sock pointer.
5. Kernel panic: The null/invalid pointer dereference in __sock_gen_cookie triggers a KASAN fault and kernel panic, crashing the system (Github Advisory, Red Hat Bugzilla).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing BUG: KASAN: null-ptr-deref in __sock_gen_cookie followed by a stack trace through bpf_iter_tcp_put_batch, bpf_iter_tcp_seq_stop, bpf_seq_read, and vfs_read.
• Logs: Kernel panic message Kernel panic - not syncing: Fatal exception appearing after BPF iterator read operations.
• Process: A process named exploit (or similar) performing read() syscalls on BPF iterator file descriptors targeting TCP sockets under memory pressure conditions.
• System: Unexpected system reboots or crashes on Linux 6.17–6.18.x/7.1.x systems where BPF is enabled and low-privilege users have access to BPF iterator functionality (Github Advisory).

Apply the upstream Linux kernel patches that fix the double sock release by emptying the batch on the reallocation failure path. Fixed commits are available for stable branches: 9f27c4f0ae35b5390ce4f7a54d3501144e41a54d, 8a726e9585ffe7bfbfad2b5279277a00973970f3, and 980a813452754f8001704744e92f7aa697c53dd3, corresponding to kernel versions 6.18.42, 7.1.6, and 7.2 respectively. As a workaround where immediate patching is not possible, restrict unprivileged BPF operations by setting kernel.unprivileged_bpf_disabled=1 via sysctl, which prevents low-privilege users from creating BPF programs and iterators (Github Advisory, Red Hat Bugzilla).

Red Hat has tracked this vulnerability via Bugzilla (Bug 2511414) with a medium severity/priority rating, and the upstream kernel CVE announcement was posted to the linux-cve-announce mailing list by Greg Kroah-Hartman (Red Hat Bugzilla). The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers (Yocto Security List). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed.