CVE-2026-74268

In the Linux kernel, the following vulnerability has been resolved:

tcp: clear sock_ops cb flags before force-closing a child socket

A child socket inherits the listener's bpfsockopscbflags via

skclonelock(). If its setup fails in tcpv4synrecvsock() /

tcpv6synrecvsock(), the child is freed through putandexit, where

inetcskprepareforcedclose() drops the socket lock and tcp_done() runs

without it.

If BPFSOCKOPSSTATECBFLAG was inherited, tcpdone() -> tcpsetstate()

calls tcpcallbpf(), which expects the lock and trips sockownedby_me():

  WARNING: include/net/sock.h:1799 at tcpsetstate+0x433/0x550

  RIP: 0010:tcpsetstate+0x433/0x550 include/net/sock.h:1799

  Call Trace:

   <IRQ>

   tcp_done+0xba/0x250 net/ipv4/tcp.c:5095

   tcpv4synrecvsock+0x850/0xa50 net/ipv4/tcp_ipv4.c:1787

   tcpcheckreq+0xf30/0x1360 net/ipv4/tcp_minisocks.c:926

   tcpv4rcv+0x1047/0x1b50 net/ipv4/tcp_ipv4.c:2164

   </IRQ>

The child is freed before it is ever established, so it should run no

sockops callback. Clear its cb flags in inetcskpreparefordestroysock(),

the common point for the IPv4, IPv6 and chtls forced-close paths and for the

MPTCP ->synrecvsock() failure path (disposechild), which reaches tcpdone()

on a child that was never established too.