Linux Kernel BPF Sockmap SelfRedirect doublecounted copied_seq
CVE-2026-98925 Published on October 23, 2026
bpf, sockmap: Fix self-redirect copied_seq double-counting
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Fix self-redirect copied_seq double-counting
When a BPF stream_verdict program redirects an skb back to the same
socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()
calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the
skb is then delivered to the socket's psock ingress queue and later
read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via
the copied_from_self accounting path. This double-counting causes
copied_seq to advance by 2x the actual data length, triggering:
TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \
rcvnxt BF2E806, fl 0
WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640
Call Trace:
tcp_recvmsg+0x10a/0x500
sock_recvmsg+0x168/0x1d0
__sys_recvfrom+0x19a/0x2a0
__x64_sys_recvfrom+0xe4/0x1f0
do_syscall_64+0xf7/0x530
entry_SYSCALL_64_after_hwframe+0x77/0x7f
cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806
WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0
Call Trace:
tcp_recvmsg_locked+0x8d1/0x2640
tcp_recvmsg+0x10a/0x500
sock_recvmsg+0x168/0x1d0
__sys_recvfrom+0x19a/0x2a0
__x64_sys_recvfrom+0xe4/0x1f0
do_syscall_64+0xf7/0x530
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fix this by converting self-redirect verdict to __SK_PASS at the
beginning of sk_psock_verdict_apply(). This bypasses the
__SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting
the __SK_PASS path queue the skb to the psock ingress queue. The
data is then read via tcp_bpf_recvmsg_parser(), which advances
copied_seq exactly once through copied_from_self. Cross-socket
redirects continue through __SK_REDIRECT with sk_psock_eat_skb()
unchanged.
Products Associated with CVE-2026-98925
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version fe735073a50eaa71aceb2e990827fe26f33cddd6 and below cf9aefb26a071cb8b6fdd761c27e022a1184946d is affected.
- Version e5c6de5fa025882babf89cecbed80acf49b987fa and below dc98def81e3c629e25fcdd5753b1db93aab27ce9 is affected.
- Version e5c6de5fa025882babf89cecbed80acf49b987fa and below ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa is affected.
- Version e5c6de5fa025882babf89cecbed80acf49b987fa and below ae1ffd04e98beefbe5d83335d506b0bcd5c2a6b3 is affected.
- Version e5c6de5fa025882babf89cecbed80acf49b987fa and below 88942054191185c6f8bea5568cbb5614d1e99af9 is affected.
- Version e5c6de5fa025882babf89cecbed80acf49b987fa and below 490a83d6386eec1d29f470c8d7331677fb46c3b7 is affected.
- Version f9b4a0b537be7a6e5f002ca64b09dcca9c14e6ed is affected.
- Version 6.1.32 and below 6.1.189 is affected.
- Version 6.3.6 and below 6.4 is affected.
- Version 6.4 is affected.
- Before 6.4 is unaffected.
- Version 6.1.189, <= 6.1.* is unaffected.
- Version 6.6.158, <= 6.6.* is unaffected.
- Version 6.12.112, <= 6.12.* is unaffected.
- Version 6.18.55, <= 6.18.* is unaffected.
- Version 7.2.9, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.