CVE-2026-74589 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users and administrators of systems running the affected Linux kernel versions, should assess exposure and prioritize remediation.

Why it matters

The CVE-2026-74589 vulnerability in the Linux kernel's bpf and sockmap components requires immediate attention from Linux kernel developers, maintainers, and users. The use-after-free error can lead to potential remote code execution, denial of service, elevation of privileges, or data tampering. Affected systems should be identified, and patches should be applied as soon as possible. Additional security measures, such as monitoring system logs and implementing compensating controls, may be necessary to detect and prevent exploitation attempts.

• Potential remote code execution or denial of service
• Elevation of privileges or unauthorized access
• Data tampering or theft due to use-after-free error
• Verification of patch application and system hardening required

Technical summary

The vulnerability exists in the Linux kernel's bpf and sockmap components. The `sk_redir` pointer is used after the referenced socket has been released, leading to a use-after-free error. This occurs when `tcp_bpf_send_verdict` copies the `sk_redir` pointer while holding the source socket lock, but does not take a reference for the local copy before dropping the lock. The use-after-free error can lead to potential remote code execution, denial of service, elevation of privileges, or data tampering. Affected systems should be identified, and patches should be applied as soon as possible. Additional security measures, such as monitoring system logs and implementing compensating controls, may be necessary to The

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Monitor system logs for potential exploitation attempts
• Implement additional security measures to detect and prevent similar vulnerabilities
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was reported by KASAN, which detected a slab-use-after-free error in `tcp_bpf_sendmsg_redir`. The error occurred when reading from address ffff888108537090. The call trace included `tcp_bpf_sendmsg_redir`, `tcp_bpf_sendmsg`, `__sys_sendto`, and `__x64_sys_sendto`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.