In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage before bailouts that access it"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk. If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to a use-after-free (UAF) on the parent socket. Fix this by resetting newsk->sk_bpf_storage to NULL immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from bpf_sk_storage_clone().

ubuntu_linux USN-8887-1: Ubuntu 26.04 LTS : Linux kernel vulnerabilities (USN-8887-1)

ubuntu_linux USN-8889-1: Ubuntu 26.04 LTS : Linux kernel (OEM) vulnerabilities (USN-8889-1)

ubuntu_linux USN-8886-1: Ubuntu 24.04 LTS / Ubuntu Pro Realtime 24.04 LTS : Linux kernel (NVIDIA Tegra) vulnerabilities (USN-8886-1)

ubuntu_linux USN-8888-1: Ubuntu 26.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8888-1)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Fix UAF in sock clone early bailouts Similar to recent commit 9b51a6155d14 (bpf,fork: wipe
    ->bpf_storage before bailouts that access it), sk_clone() performs an initial shallow copy of the socket     field ->sk_bpf_storage via sock_copy() for the cloned socket newsk. If sk_clone() bails out early (e.g. if     sk_filter_charge() fails) prior to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points to     the parent socket's BPF local storage. When newsk is subsequently freed via sk_free(), the deallocation     path (__sk_destruct() -> bpf_sk_storage_free()) destroys the parent socket's BPF local storage, leading to     a use-after-free (UAF) on the parent socket. Fix this by resetting newsk->sk_bpf_storage to NULL     immediately after sock_copy() in sk_clone(), and remove the now redundant initialization from     bpf_sk_storage_clone(). (CVE-2026-68399)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
350138	openSUSE 16: cluster-md-kmp-64kb / cluster-md-kmp-azure / cluster-md-kmp-default / etc (openSUSE-SU-2026:21910-1)	Nessus	SuSE Local Security Checks	Local	high
347900	SUSE SLED15 / SLES15 : Security update for the Linux Kernel (SUSE-SU-2026:4254-1)	Nessus	SuSE Local Security Checks	Local	high
345814	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-2143)	Nessus	Amazon Linux Local Security Checks	Local	medium
341859	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2026-130)	Nessus	Amazon Linux Local Security Checks	Local	high
334405	Linux Distros Unpatched Vulnerability : CVE-2026-68399	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-68399

high

Tenable Plugins

Coming Soon

high

high

medium

high

high