{"id":"CVE-2026-98925","kind":"vulnerability","aliases":["CVE-2026-98925"],"related":[],"title":"Linux kernel: sockmap self-redirect double-counts TCP receive sequence, triggering warnings","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix self-redirect copied_seq double-counting\n\nWhen a BPF stream_verdict program redirects an skb back to the same\nsocket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()\ncalls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the\nskb is then delivered to the socket's psock ingress queue and later\nread by tcp_bpf_recvmsg_parser(), which also advances copied_seq via\nthe copied_from_self accounting path. This double-counting causes\ncopied_seq to advance by 2x the actual data length, triggering:\n\n  TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \\\n\t\t\t   rcvnxt BF2E806, fl 0\n  WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640\n  Call Trace:\n   tcp_recvmsg+0x10a/0x500\n   sock_recvmsg+0x168/0x1d0\n   __sys_recvfrom+0x19a/0x2a0\n   __x64_sys_recvfrom+0xe4/0x1f0\n   do_syscall_64+0xf7/0x530\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806\n  WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0\n  Call Trace:\n   tcp_recvmsg_locked+0x8d1/0x2640\n   tcp_recvmsg+0x10a/0x500\n   sock_recvmsg+0x168/0x1d0\n   __sys_recvfrom+0x19a/0x2a0\n   __x64_sys_recvfrom+0xe4/0x1f0\n   do_syscall_64+0xf7/0x530\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by converting self-redirect verdict to __SK_PASS at the\nbeginning of sk_psock_verdict_apply(). This bypasses the\n__SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting\nthe __SK_PASS path queue the skb to the psock ingress queue. The\ndata is then read via tcp_bpf_recvmsg_parser(), which advances\ncopied_seq exactly once through copied_from_self. Cross-socket\nredirects continue through __SK_REDIRECT with sk_psock_eat_skb()\nunchanged.","summary":"A bug in the Linux kernel's BPF sockmap code makes a socket that redirects its own traffic advance its TCP copied sequence number twice as far as the data read. The kernel then fires TCP recvmsg warnings, and the sources do not describe any attacker-controlled data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","linux-kernel","package","sockmap"],"not_affected_if":["default-config","no-bpf-sockmap-programs"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the upstream kernel commit\n- Check whether BPF sockmap programs (BPF_MAP_TYPE_SOCKMAP with a stream_verdict program using BPF_F_INGRESS self-redirect) are loaded with `bpftool prog show`\n- Search kernel logs for the warning text with `dmesg | grep 'tcp_recvmsg_locked\\|tcp_cleanup_rbuf'`","fix":"- Update the Linux kernel to a build that includes the upstream commit 'bpf, sockmap: Fix self-redirect copied_seq double-counting'\n- Until patched, unload BPF stream_verdict programs that redirect to the same socket with BPF_F_INGRESS\n- unknown for exact fixed version numbers, as the sources do not list them","status":"open","published_at":"2026-10-23T13:17:13+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:19+00:00","updated_at":"2026-10-25T04:58:19+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:58:19Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a build that includes the upstream commit 'bpf, sockmap: Fix self-redirect copied_seq double-counting'\n- Until patched, unload BPF stream_verdict programs that redirect to the same socket with BPF_F_INGRESS\n- unknown for exact fixed version numbers, as the sources do not list them","reach":"unknown","title":"Linux kernel: sockmap self-redirect double-counts TCP receive sequence, triggering warnings","impact":"low","summary":"A bug in the Linux kernel's BPF sockmap code makes a socket that redirects its own traffic advance its TCP copied sequence number twice as far as the data read. The kernel then fires TCP recvmsg warnings, and the sources do not describe any attacker-controlled data exposure.","category":"package","nicknames":[],"who_cares":["linux-kernel","bpf","sockmap"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel warnings and TCP receive sequence corruption; worse impact unknown","analyst_note":"Check the upstream kernel commit and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98925 for fixed versions and whether the bug enables memory corruption or only warnings.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed in the upstream kernel commit\n- Check whether BPF sockmap programs (BPF_MAP_TYPE_SOCKMAP with a stream_verdict program using BPF_F_INGRESS self-redirect) are loaded with `bpftool prog show`\n- Search kernel logs for the warning text with `dmesg | grep 'tcp_recvmsg_locked\\|tcp_cleanup_rbuf'`","needs_analyst":true,"not_affected_if":["no-bpf-sockmap-programs","default-config"],"who_is_affected":"Only systems running a kernel with the sockmap code and a BPF stream_verdict program that redirects traffic back to the same socket with BPF_F_INGRESS are exposed. The sources describe kernel warnings and sequence accounting errors, not a confirmed remote compromise, so hosts without such BPF programs can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000823,"input_tokens":4148,"output_tokens":816,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':202C,208C,212C,216C,221C,226C,233C,251C,258C,262C,266C,270C,275C,280C,287C '-2026':16A,19A '-98925':17A,20A '0':194C '1609':246C '2':186C '2745':197C '2x':176C '64':225C,230C,279C,284C 'account':164C 'actual':178C 'advanc':45B,128C,156C,174C,345C 'also':155C 'appli':122C,307C 'attack':73B 'attacker-control':72B 'back':107C 'begin':302C 'bf2e7fd':190C 'bf2e806':188C,192C,239C,241C,243C 'bpf':21B,34B,87C,100C,116C,151C,341C 'bug':28B,185C,237C 'bypass':309C 'call':123C,204C,253C,316C 'case':313C 'caus':170C 'cleanup':235C,249C 'code':36B 'continu':358C 'control':74B 'convert':292C 'copi':48B,93C,131C,157C,161C,171C,187C,238C,346C,351C 'count':9A,97C,169C 'cross':355C 'cross-socket':354C 'cve':15A,18A 'data':56B,75B,179C,335C 'deliv':138C 'describ':70B 'doubl':8A,96C,168C 'double-count':7A,95C,167C 'eat':125C,319C,365C 'entir':314C 'entri':228C,282C 'exact':348C 'exposur':76B 'f':117C 'far':53B 'fire':61B 'fix':89C,289C 'fl':193C 'follow':82C 'howev':133C 'hwframe':232C,286C 'ingress':118C,144C,332C 'kernel':2A,24B,32B,59B,80C 'later':147C 'length':180C 'let':321C 'linux':1A,23B,31B,79C 'linux-kernel':22B 'lock':201C,257C 'make':37B 'net/ipv4/tcp.c':196C,245C 'number':50B 'packag':25B 'parser':153C,343C 'pass':299C,324C 'path':165C,325C 'program':103C 'psock':120C,143C,305C,318C,331C,364C 'queue':145C,326C,333C 'rbuf':236C,250C 'rcvnxt':191C,242C 'read':57B,148C,338C 'receiv':11A 'recvfrom':215C,220C,269C,274C 'recvmsg':63B,152C,183C,200C,207C,211C,256C,261C,265C,342C 'redirect':6A,41B,92C,104C,114C,295C,312C,357C,361C 'resolv':86C 'self':5A,91C,113C,163C,294C,353C 'self-redirect':4A,90C,112C,293C 'seq':94C,132C,158C,172C,184C,189C,240C,347C 'sequenc':12A,49B 'sk':119C,130C,298C,304C,311C,317C,323C,360C,363C 'skb':106C,126C,135C,320C,328C,366C 'sock':210C,264C 'socket':39B,111C,141C,356C 'sockmap':3A,26B,35B,88C 'sourc':67B 'stream':101C 'sys':214C,219C,268C,273C 'syscal':224C,229C,278C,283C 'tcp':10A,47B,62B,124C,129C,150C,182C,199C,206C,248C,255C,260C,340C 'trace':205C,254C 'traffic':44B 'trigger':13A,181C 'twice':51B 'unchang':367C 'verdict':102C,121C,296C,306C 'via':159C,339C 'vulner':83C 'warn':14A,64B,195C,244C 'x10a/0x500':209C,263C 'x168/0x1d0':213C,267C 'x19a/0x2a0':217C,271C 'x64':218C,272C 'x72b/0x2640':203C 'x77/0x7f':234C,288C 'x8d1/0x2640':259C 'xe4/0x1f0':222C,276C 'xf2/0x1c0':252C 'xf7/0x530':227C,281C","nicknames":[],"mitigations":[],"who_affected":"Only systems running a kernel with the sockmap code and a BPF stream_verdict program that redirects traffic back to the same socket with BPF_F_INGRESS are exposed. The sources describe kernel warnings and sequence accounting errors, not a confirmed remote compromise, so hosts without such BPF programs can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98925","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98925","severity":null,"published_at":"2026-10-23T13:17:13+00:00","modified_at":"2026-10-23T13:17:13+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}