CVE-2026-74714 is a use-after-free vulnerability in the Linux kernel's BPF TCP iterator function bpf_iter_tcp_established_batch(). The root cause is that the function uses sock_hold() to increment the socket reference count while holding a bucket lock, assuming the lock guarantees a positive reference count. However, for TCP request sockets, the reference count can be zero at that time, leading to an addition on zero and a use-after-free when the reference count is later overwritten. This causes the socket to be freed while still reachable, potentially leading to memory corruption. The vulnerability is reproducible with tcp_syncookies disabled and concurrent connect/close operations. The patch replaces sock_hold() with refcount_inc_not_zero() and modifies iteration logic to skip sockets that fail the increment, preventing use-after-free.

The vulnerability allows a use-after-free condition in the kernel, which can lead to memory corruption. While the exact impact is not detailed in the provided data, use-after-free bugs in kernel code can potentially be exploited to cause system crashes or privilege escalation. No known exploits in the wild have been reported. The issue affects kernel stability and security under certain TCP connection workloads.

A fix is available and has been applied to the Linux kernel to address this vulnerability. The patch uses refcount_inc_not_zero() instead of sock_hold() to safely increment reference counts and adjusts iteration logic to avoid accessing freed sockets. Users and administrators should update to the fixed kernel version as provided by their Linux distribution vendors. Patch status is not explicitly stated in the input, so check the vendor advisory for current remediation guidance.