CVE-2026-68386: bpf, sockmap: Reject unhashed UDP sockets on sockmap update

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Reject unhashed UDP sockets on sockmap update

UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means
sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.

Because sockmap accepts unbound UDP sockets, a BPF program can increment a
socket's refcount via lookup. If the socket is subsequently bound, the
transition from unbound to bound causes bpf_sk_release() to skip the
decrement of the refcount, causing a memory leak.

unreferenced object 0xffff88810bc2eb40 (size 1984):
  comm "test_progs", pid 2451, jiffies 4295320596
  hex dump (first 32 bytes):
    7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00  ................
    02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00  ...@............
  backtrace (crc bdee079d):
    kmem_cache_alloc_noprof+0x557/0x660
    sk_prot_alloc+0x69/0x240
    sk_alloc+0x30/0x460
    inet_create+0x2ce/0xf80
    __sock_create+0x25b/0x5c0
    __sys_socket+0x119/0x1d0
    __x64_sys_socket+0x72/0xd0
    do_syscall_64+0xa1/0x5f0
    entry_SYSCALL_64_after_hwframe+0x76/0x7e

Instead of special-casing for refcounted sockets, reject unhashed UDP
sockets during sockmap updates, as there is no benefit to supporting those.
This effectively reverts the commit under Fixes, with two exceptions:

1. sock_map_sk_state_allowed() maintains a fall-through `return true`.
2. In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash
   handler for BPF sockmap usage"), the proto::unhash BPF handler is not
   reintroduced.

Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject
unhashed sockets in bpf_sk_assign").

The Linux kernel CVE team has assigned CVE-2026-68386 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 0c48eefae712c2fd91480346a07a1a9cd0f9470b and fixed in 6.6.148 with commit 7ffe529e7127411806c8692fb1490f552c629dc2
	Issue introduced in 5.15 with commit 0c48eefae712c2fd91480346a07a1a9cd0f9470b and fixed in 6.12.101 with commit 17b7ef6b86112a4e61cee1e9009a4b318e3225c5
	Issue introduced in 5.15 with commit 0c48eefae712c2fd91480346a07a1a9cd0f9470b and fixed in 6.18.42 with commit 250474c69bc3fc48a5fc21d7c349f279caad947a
	Issue introduced in 5.15 with commit 0c48eefae712c2fd91480346a07a1a9cd0f9470b and fixed in 7.1.6 with commit 8692655da369961128658cf8539334b6a960ecb0
	Issue introduced in 5.15 with commit 0c48eefae712c2fd91480346a07a1a9cd0f9470b and fixed in 7.2-rc4 with commit 66efd3368ae10d05e08fbe6425b50fdec7186ac7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68386
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/sock_map.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2
	https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5
	https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a
	https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0
	https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7