External risk intelligence

Linux Kernel bpf skmsg Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64025

This Linux kernel vulnerability involves race conditions between BPF sockmap and ktls subsystems. It requires a highly specific, complex local socket configuration involving TLS offload. It is not directly exposed to the internet. Exploitation necessitates local execution or specialized local application logic to trigger the race condition in the kernel's receive queue handling.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability within the Linux kernel related to how it handles network data processing, specifically involving BPF (Berkeley Packet Filter) and TLS (Transport Layer Security) encryption. The issue arises from a race condition where the kernel might incorrectly manage data in the receive queue, potentially leading to a use-after-free error. While the problem has been resolved, understanding its nature is important for systems utilizing these specific kernel features.

Kernel bug risks data handling errors.
Affects specific Linux network processing.
Confirm relevance and confirm exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition in the Linux kernel's handling of network data when both BPF sockmaps and TLS encryption are in use. This could occur if a socket is added to a BPF sockmap before TLS encryption is fully set up. When network data arrives, the incorrect handling of the receive queue could lead to a use-after-free vulnerability.

Requires local access and specific socket configuration.
Triggered by data arrival with mixed BPF and TLS setup.
Results in a use-after-free memory error.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system services when a socket is added to a BPF sockmap before TLS receive offload is fully configured. This race condition may lead to a use-after-free vulnerability when handling incoming data.

Kernel receive queue data could be compromised.
A race condition might occur during data reception.
Unpredictable system behavior or crashes could result.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical Linux kernel vulnerability requires coordination between kernel developers, platform teams managing the kernel, and potentially application owners if BPF sockmaps are used. The first practical step is to identify all systems running the affected kernel version, confirm their exposure and business criticality, and locate the specific teams or individuals responsible for kernel maintenance and the applications interacting with BPF and TLS.

Kernel and platform teams own the issue.
Verify BPF sockmap and TLS RX usage.
Plan kernel updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel BPF and ktls interaction?

The Linux kernel uses BPF (Berkeley Packet Filter) for high-performance packet processing and ktls (kernel TLS) to offload encryption tasks. This vulnerability specifically concerns how these two subsystems coordinate when managing incoming network data on a socket, ensuring that data is processed by the correct mechanism without conflict.

What does this CVE-2026-64025 vulnerability mean?

This is a use-after-free vulnerability caused by a race condition. When the kernel incorrectly handles the packet receive queue, a memory address may be accessed after the data structure it contained has been freed. This happens because the BPF verdict logic attempts to process data that the TLS subsystem is already managing, leading to memory inconsistency.

How is this race condition triggered in the kernel?

The condition triggers when a socket is added to a BPF sockmap before the TLS receive context is fully configured. It requires data to arrive while this specific configuration mismatch exists. Standard network traffic on systems that do not use BPF sockmaps with TLS offload will not trigger this issue.

Is my system vulnerable according to Halo Surface Signal?

Halo Surface Signal indicates that this issue is very unlikely to be exposed to the internet. Because it requires a complex, local configuration of specific kernel subsystems, it is not a typical remote attack vector. The vulnerability is tied to specialized internal application logic rather than standard external-facing services.

How should I respond if my servers run this kernel?

Begin by identifying systems that utilize both BPF sockmaps and TLS receive offload features. Coordinate with your kernel maintenance team to plan for an update to a patched kernel version. Focus on systems where these specific networking features are actively implemented, rather than performing general updates across all infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.