Improper Update of Reference Count Affecting kernel-rt-64k-modules package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL10-KERNELRT64KMODULES-18625136
- published12 Aug 2026
- disclosed10 Aug 2026
Introduced: 10 Aug 2026
NewCVE-2026-68386 (opens in a new tab)How to fix?
There is no fixed version for RHEL:10 kernel-rt-64k-modules.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-rt-64k-modules package and not the kernel-rt-64k-modules package as distributed by RHEL.
See How to fix? for RHEL:10 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Reject unhashed UDP sockets on sockmap update
UDP sockets get SOCK_RCU_FREE set when (auto-)bound. This means sk_is_refcounted(unbound) = true, while sk_is_refcounted(bound) = false.
Because sockmap accepts unbound UDP sockets, a BPF program can increment a socket's refcount via lookup. If the socket is subsequently bound, the transition from unbound to bound causes bpf_sk_release() to skip the decrement of the refcount, causing a memory leak.
unreferenced object 0xffff88810bc2eb40 (size 1984): comm "test_progs", pid 2451, jiffies 4295320596 hex dump (first 32 bytes): 7f 00 00 01 7f 00 00 01 d2 04 1b b7 04 d2 00 00 ................ 02 00 01 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace (crc bdee079d): kmem_cache_alloc_noprof+0x557/0x660 sk_prot_alloc+0x69/0x240 sk_alloc+0x30/0x460 inet_create+0x2ce/0xf80 __sock_create+0x25b/0x5c0 __sys_socket+0x119/0x1d0 __x64_sys_socket+0x72/0xd0 do_syscall_64+0xa1/0x5f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e
Instead of special-casing for refcounted sockets, reject unhashed UDP sockets during sockmap updates, as there is no benefit to supporting those. This effectively reverts the commit under Fixes, with two exceptions:
- sock_map_sk_state_allowed() maintains a fall-through
return true. - In the spirit of commit b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage"), the proto::unhash BPF handler is not reintroduced.
Historical note: this issue is related to commit 67312adc96b5 ("bpf: reject unhashed sockets in bpf_sk_assign").
References
- https://bugzilla.redhat.com/show_bug.cgi?id=2513442
- https://access.redhat.com/security/cve/CVE-2026-68386
- https://git.kernel.org/stable/c/17b7ef6b86112a4e61cee1e9009a4b318e3225c5
- https://git.kernel.org/stable/c/250474c69bc3fc48a5fc21d7c349f279caad947a
- https://git.kernel.org/stable/c/66efd3368ae10d05e08fbe6425b50fdec7186ac7
- https://git.kernel.org/stable/c/7ffe529e7127411806c8692fb1490f552c629dc2
- https://git.kernel.org/stable/c/8692655da369961128658cf8539334b6a960ecb0