In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs, leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers. bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr 0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64 entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception

ubuntu_linux USN-8887-1: Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)

ubuntu_linux USN-8889-1: Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

ubuntu_linux USN-8888-1: Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on
    batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops
    the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are
    kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs,
    leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers.
    bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct
    sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already
    freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from
    the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references
    and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr
    0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch
    (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read
    (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64
    entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception (CVE-2026-64575)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on     batch realloc bpf_iter_tcp_batch() releases the current batch via bpf_iter_tcp_put_batch(), which drops     the socket refs and rewrites each slot with the socket cookie, then grows the batch. cur_sk/end_sk are     kept for bpf_iter_tcp_resume(), but on realloc failure the function returns ERR_PTR() before resume runs,     leaving cur_sk < end_sk over slots that now hold cookies rather than sock pointers.
    bpf_iter_tcp_seq_stop() then calls bpf_iter_tcp_put_batch() again and dereferences a cookie as a struct     sock. Empty the batch on the failure path so stop() does not release it again. The sockets were already     freed by the first bpf_iter_tcp_put_batch(), so nothing leaks, and a later read() rescans the bucket from     the start instead of skipping it. The sibling GFP_NOWAIT failure path still holds real socket references     and is left for stop() to release. BUG: KASAN: null-ptr-deref in __sock_gen_cookie Read of size 8 at addr     0000000000000059 by task exploit ... __sock_gen_cookie (net/core/sock_diag.c:28) bpf_iter_tcp_put_batch     (net/ipv4/tcp_ipv4.c:2918) bpf_iter_tcp_seq_stop (net/ipv4/tcp_ipv4.c:3270) bpf_seq_read     (kernel/bpf/bpf_iter.c:205) vfs_read (fs/read_write.c:572) ksys_read (fs/read_write.c:716) do_syscall_64     entry_SYSCALL_64_after_hwframe Kernel panic - not syncing: Fatal exception (CVE-2026-64575)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
471298	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Cloud Security	Google COS Security Checks	Local	high
471298	Google: sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_18: security update to 20085.0.0	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
470514	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Cloud Security	Google COS Security Checks	Local	high
470514	Google: sys-kernel/cchost-kernel-6_12, sys-kernel/cchost-kernel-6_18, sys-kernel/csql-kernel-6_12, sys-kernel/csql-kernel-6_18, sys-kernel/lakitu-kernel-6_12, sys-kernel/lakitu-kernel-6_18, sys-kernel/lakitu-nc-kernel-6_12, sys-kernel/lakitu-nc-kernel-6_18: security update to 19999.44.21	Tenable Self-Hosted Container Security	Google COS Security Checks	Local	high
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
332747	Linux Distros Unpatched Vulnerability : CVE-2026-64575	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-64575

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high