https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:18:13 +0000 https://cve.radiocsirt.org/vuln/cve-2022-49697 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>bpf: Fix request_sock leak in sk lookup helpers</p> <p>A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was finding the request_socket but returning the parent LISTEN socket via sk_to_full_sk() without decrementing the child request socket 1st, resulting in request_sock slab object leak. This patch retains the existing behaviour of returning full socks to the caller but it also decrements the child request_socket if one is present before doing so to prevent the leak.</p> <p>Thanks to Curtis Taylor for all the help in diagnosing and testing this. And thanks to Antoine Tenart for the reproducer and patch input.</p> <p>v2 of this patch contains, refactor as per Daniel Borkmann&#39;s suggestions to validate RCU flags on the listen socket so that it balances with bpf_sk_release() and update comments as per Martin KaFai Lau&#39;s suggestion. One small change to Daniels suggestion, put &#34;sk = sk2&#34; under &#34;if (sk2 != sk)&#34; to avoid an extra instruction.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>bpf: Fix request_sock leak in sk lookup helpers</p> <p>A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was finding the request_socket but returning the parent LISTEN socket via sk_to_full_sk() without decrementing the child request socket 1st, resulting in request_sock slab object leak. This patch retains the existing behaviour of returning full socks to the caller but it also decrements the child request_socket if one is present before doing so to prevent the leak.</p> <p>Thanks to Curtis Taylor for all the help in diagnosing and testing this. And thanks to Antoine Tenart for the reproducer and patch input.</p> <p>v2 of this patch contains, refactor as per Daniel Borkmann&#39;s suggestions to validate RCU flags on the listen socket so that it balances with bpf_sk_release() and update comments as per Martin KaFai Lau&#39;s suggestion. One small change to Daniels suggestion, put &#34;sk = sk2&#34; under &#34;if (sk2 != sk)&#34; to avoid an extra instruction.</p> https://cve.radiocsirt.org/vuln/cve-2022-49697