CVE-2026-98925
NoneCVSS
—
EPSS
0.2%
Published
Oct 23, 2026
CISA due date
—
Cloudanix analysis
A bug in how the Linux kernel handles certain network socket redirections can cause incorrect data counting, leading to warning messages and possible disruptions for network applications.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- OS kernel
- Class
- Other
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
In the Linux kernel BPF sockmap, self-redirecting an skb via stream_verdict causes tcp_eat_skb to advance copied_seq, followed by tcp_bpf_recvmsg_parser also advancing it via copied_from_self, resulting in copied_seq advancing twice the actual data length and triggering warnings in tcp_recvmsg_locked and tcp_cleanup_rbuf.
Why it matters to the business
Systems using BPF sockmap for self-redirects may experience TCP receive buffer warnings, potential application errors in reading data, and instability in network processing, affecting services relying on high-performance socket redirection.
How an attack unfolds
An attacker would need to trigger a BPF stream_verdict program that performs a self-redirect with BPF_F_INGRESS on a socket, causing the double-counting bug to activate and produce warnings or disrupt TCP state.
How to fix it
Update the Linux kernel to a patched version that converts self-redirect verdicts to __SK_PASS early in sk_psock_verdict_apply to avoid double advancement of copied_seq.
How to confirm the fix worked
After patching, confirm absence of 'TCP recvmsg seq # bug' and 'cleanup rbuf bug' warnings in kernel logs during BPF sockmap self-redirect usage; test affected eBPF programs for correct copied_seq behavior.
Typical attack path
- Identify or deploy a BPF program using stream_verdict with self-redirect capability
- Send network traffic that triggers the verdict to redirect the skb back to the same socket
- Observe resulting TCP sequence warnings in kernel logs and potential recvmsg failures
How to detect it
Review kernel logs (dmesg, syslog) for the exact warning strings mentioning copied_seq, tcp_recvmsg_locked, and tcp_cleanup_rbuf in conjunction with BPF sockmap activity.
What your security team should do
- Apply available Linux kernel updates addressing the BPF sockmap self-redirect issue as soon as possible
- Audit eBPF programs for stream_verdict self-redirect patterns and test them under load
- Enable kernel logging for TCP warnings to detect occurrences in production environments
The record
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \ rcvnxt BF2E806, fl 0 WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640 Call Trace: tcp_recvmsg+0x10a/0x500 sock_recvmsg+0x168/0x1d0 __sys_recvfrom+0x19a/0x2a0 __x64_sys_recvfrom+0xe4/0x1f0 do_syscall_64+0xf7/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806 WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0 Call Trace: tcp_recvmsg_locked+0x8d1/0x2640 tcp_recvmsg+0x10a/0x500 sock_recvmsg+0x168/0x1d0 __sys_recvfrom+0x19a/0x2a0 __x64_sys_recvfrom+0xe4/0x1f0 do_syscall_64+0xf7/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by converting self-redirect verdict to __SK_PASS at the beginning of sk_psock_verdict_apply(). This bypasses the __SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting the __SK_PASS path queue the skb to the psock ingress queue. The data is then read via tcp_bpf_recvmsg_parser(), which advances copied_seq exactly once through copied_from_self. Cross-socket redirects continue through __SK_REDIRECT with sk_psock_eat_skb() unchanged.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|