CVE-2026-64025: Linux Kernel BPF skmsg Security Vulnerability

Linux kernel is the heart of the Linux operating system. It manages hardware resources, memory, processes and networking. Vulnerabilities in the kernel can pose serious security risks because the kernel has the highest system privileges. 
CVE-2026-64025 is a security flaw in the BPF socket message (skmsg) subsystem and Kernel TLS (KTLS) interaction. The issue is due to a race condition which can result in improper socket receive queue handling, the official Linux kernel security advisory says. Supported versions of the Linux kernel have had this vulnerability patched in an update. 

What is CVE-2026-64025? 

CVE-2026-64025 Linux Kernel BPF skmsg Subsystem and Kernel TLS (kTLS) Interaction Vulnerability. The vulnerability is caused by a race condition in socket message processing, which results in inconsistent processing of receive callbacks for some conditions. The Linux kernel maintainers argue that Kernel TLS correctly manages socket receive operations by changing the callback handling logic. 

What is Linux Kernel BPF skmsg? 

BPF skmsg is a Linux kernel feature in the Extended Berkeley Packet Filter (eBPF) framework that allows eBPF programs to inspect, filter, redirect or modify socket messages before they are delivered to an application. It is commonly used in high-performance networking, load balancing, service meshes and network security solutions. BPF skmsg allows socket data processing in kernel to improve network efficiency and enable programmable packet processing. 

What is Kernel TLS (kTLS)? 

Kernel TLS (kTLS) is a feature of the Linux kernel that performs Transport Layer Security (TLS) encryption and decryption in the kernel rather than in user space. This allows all sorts of things like web servers, storage systems, cloud services, etc to use high speed encrypted communications. It also reduces CPU overhead and improves networking performance. This feature works in tandem with the networking stack to securely transmit encrypted data. 

Understanding Race Condition Vulnerabilities (CWE-362) 

Race Condition (CWE-362) – A race condition occurs when two or more threads, processes or kernel components access the same shared resource at the same time, without proper synchronization. If the operations are performed in an unexpected order, the system can enter an inconsistent state which can lead to incorrect behavior, memory corruption or instability of the system. The race condition vulnerability is of particular importance in operating system kernels, where multiple kernel subsystems often access shared resources concurrently. 

How Does CVE-2026-64025 Work? 

As per the official advisory for the Linux kernel, the vulnerability exists due to the use of BPF skmsg along with Kernel TLS (kTLS) while processing socket receive events. If certain timing conditions are met, both components could attempt to handle the same socket receive callback leading to a race condition. This leads to inconsistent handling of the receive queue and unsafe kernel behavior. The official security patch updates the callback handling mechanism to ensure Kernel TLS maintains proper control while TLS receive processing is active, and thus avoids the race condition. 

Affected Linux Kernel Versions 

The vulnerability affects Linux kernel versions with the vulnerable implementation before the release of the official patches. According to the Linux kernel security advisory, the issue was introduced during the Linux 5.10 development cycle and has been resolved in multiple stable kernel branches, including 6.6.142, 6.12.92, 6.18.34, 7.0.11, and later supported releases. The users should run the kernel updates provided by their Linux distribution to fully mitigate this vulnerability. 

CVSS Score and Severity of CVE-2026-64025 

As of writing, the National Vulnerability Database (NVD) has not issued an official CVSS v3.1 score for CVE-2026-64025. But the Linux kernel project has released official security patches so the issue should be fixed soon. To mitigate potential security risks, administrators should watch for security advisories from vendors and install updated kernel packages as soon as they are released. 

Impact of CVE-2026-64025

CVE-2026-64025 triggers an improper socket receive queue handling in the Linux kernel due to a race condition between BPF skmsg and Kernel TLS processing. This could result in kernel warnings, system instability or denial-of-service (DoS) against applications that use the affected networking features. Currently there are no known reports of active exploitation in the wild. It is advised to apply the official Linux kernel security updates to ensure system stability and security. 

Technical Impact & Kernel UAF Stability Risks

CVE-2026-64025: Use-After-Free (UAF) bug in the Linux kernel BPF sockmap (skmsg) subsystem and Kernel Transport Layer Security (kTLS) receive path, a race condition.  

The bug is that sk_psock_verdict_data_ready() does not check if there is an active TLS RX context (tls_sw_has_ctx_rx()). When a TCP socket is attached to a sockmap (BPF_SK_SKB_VERDICT) before configuring kTLS RX, the BPF verdict callback races with kTLS, draining the socket receive queue without updating copied_seq. This results in a socket buffer memory corruption when tls_decrypt_sg() walks a corrupted buffer list (frag_list) and allows local attackers with CAP_BPF or CAP_NET_ADMIN privileges to cause a denial of service (system crash) or possibly execute arbitrary code in kernel space. 

How to Detect CVE-2026-64025 

• Inspect Kernel Version and Config: Check if your system kernel runs with both CONFIG_BPF_SYSCALL and CONFIG_TLS enabled without the upstream patch applied. 

• Monitor Kernel Crash Logs (dmesg / syslog): Search system logs for specific kernel splats or panic traces containing: 

• WARN_ON_ONCE(!first) triggered inside tcp_recv_skb() 

• Traces involving sk_psock_verdict_data_ready, tls_strp_msg_load, or tls_decrypt_sg 

• Analyze KASAN Reports: Look for KASAN (KernelAddressSanitizer) Use-After-Free reports in the TLS receive path referencing freed sk_buff structures. 

• Audit BPF & Network Configurations: Identify local applications using BPF_SK_SKB_VERDICT programs alongside kTLS on TCP sockets. 

How to Fix CVE-2026-64025 

Update the Linux Kernel: Apply the official upstream fix commit (bpf, skmsg: fix verdict sk_data_ready racing with ktls rx) through your distribution’s security repository (e.g., Ubuntu, RHEL, Debian, SUSE). The patch adds the missing tls_sw_has_ctx_rx() check in sk_psock_verdict_data_ready(). 

Reboot the System: Restart the operating system to ensure the updated kernel image is loaded into memory. 

Restrict BPF Capabilities (Mitigation): Restrict eBPF access by removing CAP_BPF and CAP_NET_ADMIN capabilities from untrusted applications and containers, or disable unprivileged eBPF via sysctl: 

Bash 

sysctl -w kernel.unprivileged_bpf_disabled=1 

Best Practices to Prevent Linux Kernel Race Condition Vulnerabilities 

• Enforce State Validation & Guards: Ensure state-checking guards (like checking active TLS contexts) are applied symmetrically across all asynchronous callback and event-handling paths. 

• Utilize Proper Synchronization Primitives: Use appropriate spinlocks, RCU (Read-Copy-Update) synchronization, or atomic operations when multiple subsystems (e.g., eBPF and network stack) access shared socket structures. 

• Integrate KASAN and Concurrency Testing: Test kernel modules and network subsystems using KASAN and concurrency testing tools (such as syzkaller and ThreadSanitizer) during CI/CD builds to catch race conditions before production deployment. 

• Principle of Least Privilege: Enforce strict capability checks (CAP_BPF, CAP_NET_ADMIN) to prevent non-root users from attaching arbitrary socket-filtering programs to network sockets. 

To ensure round-the-clock infrastructure availability, proactive security hardening, and rapid vulnerability patching, partnering with proactive server management and security support safeguards servers against unauthorized access and operational downtime.

Frequently Asked Questions