In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copied_seq double-counting When a BPF… (CVE-2026-98925)

The Linux kernel vulnerability (CVE-2026-98925) involves the BPF sockmap feature where a BPF stream_verdict program redirects a socket buffer (skb) back to the same socket using BPF_F_INGRESS. The function sk_psock_verdict_apply() calls tcp_eat_skb() advancing tcp_sk->copied_seq, but the skb is also delivered to the socket's psock ingress queue and later processed by tcp_bpf_recvmsg_parser(), which advances copied_seq again via copied_from_self accounting. This double-counting causes copied_seq to advance twice the actual data length, triggering TCP receive message sequence warnings and cleanup buffer bugs. The fix converts the self-redirect verdict to __SK_PASS early in sk_psock_verdict_apply(), bypassing the __SK_REDIRECT path and ensuring copied_seq advances only once. Cross-socket redirects remain unaffected and continue through the original path.

The vulnerability causes TCP sequence number accounting errors during self-redirects in BPF sockmap, leading to kernel warnings and potential TCP receive buffer inconsistencies. There is no indication of remote code execution or privilege escalation. The impact is primarily on kernel stability and correctness of TCP stream handling under specific BPF redirect scenarios.

A fix has been implemented in the Linux kernel to address this issue by modifying the handling of self-redirect verdicts in sk_psock_verdict_apply(). Users should update to a Linux kernel version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel patch or upgrading to a fixed kernel release is the recommended remediation.