From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C87D31A5BAE for ; Sun, 19 Jul 2026 15:40:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475620; cv=none; b=DKDarUPNfnkB9LOK2ddxtQCmI0ueVb5uw/uG9B1R2/6YAyPR2LLf5w+InZy3EyZxlixFyPUL3yVdkISgUzEb4jCt7AzjuHOOFkafEsiqDCZ2z4ZICIfXw12NinSegzVTIY/BabLA8XgyQiS8Iz9LbtmCR8bN/NpZTvcR/WEKryc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475620; c=relaxed/simple; bh=JKSJ+oTQaKmRFXFyOK+j4dVr2WEPVgsChJjUlwSdoCA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=MN9gTwIpE/YfpPe2L0pzBdTvkAQUoV3NyfTRFY/VjfSTg0WNW5r3l1W92ijsVDDZ8BAO2/l2BCxe5f3fd3PzEj05yVHGEZBmrHjfmh1qEcPfhnv3mElJayoID3lUyqllvcXs3a4eLGuwBTzZxqxBIEE07p5R7PmrJfzlNMEgTv8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=SoEBgOIk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="SoEBgOIk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E3BCA1F000E9; Sun, 19 Jul 2026 15:40:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475619; bh=WUnbGcB87YLfRIBIqCAqJRC0VOKdA5qhtC8bbpRFQZ4=; h=From:To:Cc:Subject:Date:Reply-To; b=SoEBgOIktyREHroCsZB+hstJct+xhOACYarBv13W10mVElY3OruQKOZikvjVMkQ1W ZXsHp6uEz8eKlxWyJnA5UIJ0YwERIE3PwavzSFhsh/drnqa3kqiZ3Ot27A58VGhzvq zG60E5z0m/KqzJgPFmReQ171Bdymr3S7urineAto= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64025: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx Date: Sun, 19 Jul 2026 17:38:07 +0200 Message-ID: <2026071902-CVE-2026-64025-88f2@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3879; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=y/VoEIUn6tXivpsmP+k0r6Sf/bkqFgEu5rkZx6+3Suw=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx76PEmy9UuN4W3bdAeM8T3hM2T1MsGFXea4fmP76tr vN892P3jlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhIsDLD/GDH4vmb/M+8frfn xfrsU5s/mvwSOciwYEm0UILjqVCfWQv0D0U0uUVemp9yAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk_data_ready racing with ktls rx sk_psock_strp_data_ready() already checks tls_sw_has_ctx_rx() and defers to psock->saved_data_ready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership of the receive queue (commit e91de6afa81c, "bpf: Fix running sk_skb program types with ktls"). sk_psock_verdict_data_ready() has no equivalent guard. When a socket is inserted into a sockmap (BPF_SK_SKB_VERDICT) before TLS RX is configured, tls_sw_strparser_arm() saves sk_psock_verdict_data_ready as rx_ctx->saved_data_ready. On data arrival: tls_data_ready -> tls_strp_data_ready -> tls_rx_msg_ready -> saved_data_ready() = sk_psock_verdict_data_ready() -> tcp_read_skb() drains sk_receive_queue via __skb_unlink() without calling tcp_eat_skb(), so copied_seq is not advanced. tls_strp_msg_load() then finds tcp_inq() >= full_len (stale), calls tcp_recv_skb() on the now-empty queue, hits WARN_ON_ONCE(!first), and returns with rx_ctx->strp.anchor.frag_list pointing at a psock-owned (potentially freed) skb. tls_decrypt_sg() subsequently walks that frag_list: use-after-free. Apply the same fix as sk_psock_strp_data_ready(): if a TLS RX context is present, call psock->saved_data_ready (sock_def_readable) to wake recv() waiters and return immediately, leaving the receive queue untouched. TLS retains sole ownership of the queue and decrypts the record normally through tls_sw_recvmsg(). The Linux kernel CVE team has assigned CVE-2026-64025 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10 with commit ef5659280eb13e8ac31c296f58cfdfa1684ac06b and fixed in 6.6.142 with commit c9ea01768903ae47f210cd457af1dead6de7a9c3 Issue introduced in 5.10 with commit ef5659280eb13e8ac31c296f58cfdfa1684ac06b and fixed in 6.12.92 with commit 7c8cf21bc4efb4af18d6096db3f8bd06d622251c Issue introduced in 5.10 with commit ef5659280eb13e8ac31c296f58cfdfa1684ac06b and fixed in 6.18.34 with commit 1861d369efd62d67796563bf3e01fc22e5626f8b Issue introduced in 5.10 with commit ef5659280eb13e8ac31c296f58cfdfa1684ac06b and fixed in 7.0.11 with commit 8a52139560f833c3975032e1f5762611e3a36d71 Issue introduced in 5.10 with commit ef5659280eb13e8ac31c296f58cfdfa1684ac06b and fixed in 7.1 with commit ddf8029623a1af20e984c040e89ff918158397ab Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64025 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/core/skmsg.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c9ea01768903ae47f210cd457af1dead6de7a9c3 https://git.kernel.org/stable/c/7c8cf21bc4efb4af18d6096db3f8bd06d622251c https://git.kernel.org/stable/c/1861d369efd62d67796563bf3e01fc22e5626f8b https://git.kernel.org/stable/c/8a52139560f833c3975032e1f5762611e3a36d71 https://git.kernel.org/stable/c/ddf8029623a1af20e984c040e89ff918158397ab