---
id: "CVE-2026-98925"
kind: "vulnerability"
aliases: ["CVE-2026-98925"]
title: "Linux kernel: sockmap self-redirect double-counts TCP receive sequence, triggering warnings"
severity: "unknown"
cvss: null
epss: 0.00225
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bpf", "linux-kernel", "package", "sockmap"]
not_affected_if: ["default-config", "no-bpf-sockmap-programs"]
published_at: "2026-10-23T13:17:13+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98925", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98925", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: sockmap self-redirect double-counts TCP receive sequence, triggering warnings

A bug in the Linux kernel's BPF sockmap code makes a socket that redirects its own traffic advance its TCP copied sequence number twice as far as the data read. The kernel then fires TCP recvmsg warnings, and the sources do not describe any attacker-controlled data exposure.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed in the upstream kernel commit
- Check whether BPF sockmap programs (BPF_MAP_TYPE_SOCKMAP with a stream_verdict program using BPF_F_INGRESS self-redirect) are loaded with `bpftool prog show`
- Search kernel logs for the warning text with `dmesg | grep 'tcp_recvmsg_locked\|tcp_cleanup_rbuf'`

## Fix

- Update the Linux kernel to a build that includes the upstream commit 'bpf, sockmap: Fix self-redirect copied_seq double-counting'
- Until patched, unload BPF stream_verdict programs that redirect to the same socket with BPF_F_INGRESS
- unknown for exact fixed version numbers, as the sources do not list them

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98925
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98925

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix self-redirect copied_seq double-counting

When a BPF stream_verdict program redirects an skb back to the same
socket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()
calls tcp_eat_skb() which advances tcp_sk->copied_seq. However, the
skb is then delivered to the socket's psock ingress queue and later
read by tcp_bpf_recvmsg_parser(), which also advances copied_seq via
the copied_from_self accounting path. This double-counting causes
copied_seq to advance by 2x the actual data length, triggering:

  TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \
			   rcvnxt BF2E806, fl 0
  WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640
  Call Trace:
   tcp_recvmsg+0x10a/0x500
   sock_recvmsg+0x168/0x1d0
   __sys_recvfrom+0x19a/0x2a0
   __x64_sys_recvfrom+0xe4/0x1f0
   do_syscall_64+0xf7/0x530
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

  cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806
  WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0
  Call Trace:
   tcp_recvmsg_locked+0x8d1/0x2640
   tcp_recvmsg+0x10a/0x500
   sock_recvmsg+0x168/0x1d0
   __sys_recvfrom+0x19a/0x2a0
   __x64_sys_recvfrom+0xe4/0x1f0
   do_syscall_64+0xf7/0x530
   entry_SYSCALL_64_after_hwframe+0x77/0x7f

Fix this by converting self-redirect verdict to __SK_PASS at the
beginning of sk_psock_verdict_apply(). This bypasses the
__SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting
the __SK_PASS path queue the skb to the psock ingress queue. The
data is then read via tcp_bpf_recvmsg_parser(), which advances
copied_seq exactly once through copied_from_self. Cross-socket
redirects continue through __SK_REDIRECT with sk_psock_eat_skb()
unchanged.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_