Not yet scoredPublished Oct 23, 2026

CVE-2026-98925bpf, sockmap: Fix self-redirect copied_seq double-counting

Updated under an hour ago (Oct 27, 2026, 9:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF stream_verdict program redirects an skb back to the same socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply() calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the skb is then delivered to the socket's psock ingress queue and later read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via the copied_from_self accounting path. This double-counting causes copied_seq to advance by 2x the actual data length, triggering: TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \ rcvnxt BF2E806, fl 0 WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640 Call Trace: tcp_recvmsg+0x10a/0x500 sock_recvmsg+0x168/0x1d0 __sys_recvfrom+0x19a/0x2a0 __x64_sys_recvfrom+0xe4/0x1f0 do_syscall_64+0xf7/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806 WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0 Call Trace: tcp_recvmsg_locked+0x8d1/0x2640 tcp_recvmsg+0x10a/0x500 sock_recvmsg+0x168/0x1d0 __sys_recvfrom+0x19a/0x2a0 __x64_sys_recvfrom+0xe4/0x1f0 do_syscall_64+0xf7/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by converting self-redirect verdict to __SK_PASS at the beginning of sk_psock_verdict_apply(). This bypasses the __SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting the __SK_PASS path queue the skb to the psock ingress queue. The data is then read via tcp_bpf_recvmsg_parser(), which advances copied_seq exactly once through copied_from_self. Cross-socket redirects continue through __SK_REDIRECT with sk_psock_eat_skb() unchanged.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 23, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from fe735073a50eaa71aceb2e990827fe26f33cddd6 before cf9aefb26a071cb8b6fdd761c27e022a1184946d; from e5c6de5fa025882babf89cecbed80acf49b987fa before dc98def81e3c629e25fcdd5753b1db93aab27ce9; from e5c6de5fa025882babf89cecbed80acf49b987fa before ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa; from e5c6de5fa025882babf89cecbed80acf49b987fa before ae1ffd04e98beefbe5d83335d506b0bcd5c2a6b3; from e5c6de5fa025882babf89cecbed80acf49b987fa before 88942054191185c6f8bea5568cbb5614d1e99af9; from e5c6de5fa025882babf89cecbed80acf49b987fa before 490a83d6386eec1d29f470c8d7331677fb46c3b7; f9b4a0b537be7a6e5f002ca64b09dcca9c14e6ed; from 6.1.32 before 6.1.189; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/cf9aefb26a071cb8b6fdd761c27e022a1184946d
https://git.kernel.org/stable/c/dc98def81e3c629e25fcdd5753b1db93aab27ce9
https://git.kernel.org/stable/c/ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa
https://git.kernel.org/stable/c/ae1ffd04e98beefbe5d83335d506b0bcd5c2a6b3
https://git.kernel.org/stable/c/88942054191185c6f8bea5568cbb5614d1e99af9
https://git.kernel.org/stable/c/490a83d6386eec1d29f470c8d7331677fb46c3b7

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.