CVE-2026-98384

Executive Summary

CVE-2026-98384 is an out-of-bounds read vulnerability in the Linux kernel's eBPF subsystem, specifically within the bpf_sock_destroy() helper. The flaw occurs because sk_protocol resides in struct sock rather than struct sock_common; when the TCP iterator passes a TIME_WAIT or NEW_SYN_RECV socket that is not a full struct sock, reading sk->sk_protocol accesses memory beyond the object boundary, as confirmed by the KASAN slab-out-of-bounds report. Systems running a kernel with the affected eBPF socket iterator path are impacted, and exploitation requires the ability to load and execute BPF programs (typically elevated privileges), making this primarily a local privilege boundary or kernel-crash/stability issue.

Technical Analysis

The vulnerability is a classic CWE-125 out-of-bounds read stemming from an incorrect type assumption in the kernel's eBPF helper implementation. The NVD description and accompanying KASAN trace make the mechanism explicit:

• sk_protocol is a member of struct sock, not of struct sock_common.
• The TCP iterator (bpf_iter_tcp_seq_show → bpf_iter_run_prog → the BPF program) traverses TCP sequence entries, which can yield TIME_WAIT or request (NEW_SYN_RECV) sockets.
• Those socket states are not full struct sock objects. Therefore, when bpf_sock_destroy() reads sk->sk_protocol, the read runs past the actual allocated object.

The KASAN report captures the precise failure:

BUG: KASAN: slab-out-of-bounds in bpf_sock_destroy+0xc7/0xe0
Read of size 2 at addr ffff8881047d11b4 by task test_progs/428

The read is 2 bytes (consistent with sk_protocol, a __u16-sized field). The call trace flows from a user-space read() (ksys_read → vfs_read → bpf_seq_read) into bpf_iter_tcp_seq_show, then into the loaded BPF program bpf_prog_c3dd61f9d9cd9f37_iter_tcp6_timewait, and finally into the vulnerable helper bpf_sock_destroy.

The fix, as described, is to only check sk_protocol on full sockets, because tcp_abort() already correctly handles TIME_WAIT and NEW_SYN_RECV sockets. The description also notes that a comment in the code never matched the implementation — a documentation defect corrected alongside the logic fix.

Attack surface: the eBPF TCP iterator, exposed through the BPF iterator program type and exercised via a BPF sequence file read (the bpf_iter_tcp_seq_show/bpf_seq_read path). Attaching a BPF_PROG_TYPE_ITER program to the tcp6_timewait (and related TCP) iterator and invoking bpf_sock_destroy() on a yielded non-full socket triggers the read.

Note on specificity: No public PoC, Nuclei template, or exploit code is available. Repository packages, affected version numbers, and a concrete upstream commit are absent from the provided data, so the analysis is limited to the mechanism captured in the KASAN trace and patch description.

Exploitation Scenarios

No public PoC available; attack chain is inferred from vulnerability class (CWE-125 out-of-bounds read reachable via the BPF TCP iterator).

1. Reconnaissance / target identification. An attacker profiles a target host to determine whether it runs a Linux kernel with the affected eBPF socket iterator support. This includes verifying kernel version/build characteristics and confirming that BPF iterator programs (BPF_PROG_TYPE_ITER) are loadable. Where unprivileged BPF is enabled, a lower-privileged local user may be able to reach the iterator; otherwise, this requires CAP_BPF/CAP_SYS_ADMIN-class access or root.

2. Triggering the flaw class. The attacker attaches a BPF iterator program to the TCP iterator (the trace shows the iter_tcp6_timewait variant). When the iterator yields a TIME_WAIT or request (NEW_SYN_RECV) socket — objects that are not full struct sock instances — and the program calls the bpf_sock_destroy() helper, the helper dereferences sk->sk_protocol. Because sk_protocol belongs to struct sock and not struct sock_common, the field offset lands beyond the smaller socket object, producing a 2-byte out-of-bounds read (the read is performed via the kernel's instrumented load path, as shown by __asan_report_load2_noabort).

3. Payload / execution method (vulnerability-class level). The payload is a BPF program (loader + iterator attachment) whose logic invokes bpf_sock_destroy() against the non-full socket object. The kernel-side read of the out-of-bounds 2 bytes is the exploitation primitive. No further code-level detail beyond the NVD description is asserted here.

4. Post-exploitation impact. The immediate confirmed effect is a KASAN-detected slab-out-of-bounds read. In production (non-KASAN) kernels, the out-of-bounds read of 2 bytes may return adjacent slab data or, depending on memory layout, result in a kernel fault or crash — a denial-of-service / kernel-stability impact. The read itself does not, per the provided data, demonstrate an information disclosure to user space or a write primitive, so impact is bounded to the read and its consequences (potential crash, potential disclosure only if the value is subsequently observable — not established here).

Impact Assessment

The vulnerability class is CWE-125 (out-of-bounds read). Given a local attack vector and the requirement for the ability to load/execute BPF iterator programs (typically privileged), the realistic impact is twofold: kernel instability (crash/DoS) from an invalid read, and — if the out-of-bounds value is in any way surfaced — limited information disclosure. There is no evidence of a write primitive or a directly exploitable code-execution chain in the provided data.

• Affected systems: Linux kernels exposing the affected eBPF TCP-iterator path. The exact version range is not enumerated in the supplied data (Affected Versions: [] / OSV Packages: N/A).
• Blast radius: Any host where the eBPF iterator helper can be invoked. The KASAN trace shows it exercised in a test context (test_progs), which indicates the code path is reachable via standard BPF test/selftest tooling and, more importantly, via any loaded iterator program.
• CVSS: No official CVSS score, vector, or subscores were provided (score: N/A). Any vector reproduced in this report is illustrative and must not be treated as vendor-assigned. EPSS has not been scored by FIRST.org; no fabricated value is given. CISA KEV: not listed.

Because Patch Confidence is 0/4 (UNPATCHED — no patch evidence from any tracked source) and no workarounds or vendor fix are recorded, unmitigated exposure persists wherever affected kernels are in use.

Detection Guidance

Detections below target the load/use of BPF iterator programs and the anomalous kernel behavior associated with the out-of-bounds read. Because no public PoC exists, these rules are heuristic and should be tuned to baseline.

Sigma Rule

title: Suspicious BPF Iterator Program Targeting TCP Sockets
id: 3f9a7c2e-8b41-4d6a-9c2f-98384cve0001
status: experimental
description: Detects loading of BPF iterator programs that exercise TCP socket iteration, consistent with abuse of the bpf_sock_destroy out-of-bounds read (CVE-2026-98384).
author: Threat Intelligence
date: 2026/01/01
logsource:
  product: linux
  service: auditd
detection:
  selection_bpf_syscall:
    type: 'SYSCALL'
    syscall: 'bpf'
    key: 'bpf'
  selection_iterator_context:
    - exe|endswith: 'bpf'
    - comm: 'test_progs'
    - a0|contains: 'BPF_PROG_TYPE_ITER'
  selection_socket_destroy:
    - a1|contains: 'bpf_sock_destroy'
    - a1|contains: 'iter_tcp'
  condition: selection_bpf_syscall and (selection_iterator_context or selection_socket_destroy)
falsepositives:
  - Legitimate BPF selftests and kernel test suites
  - Authorized performance/observability tooling
level: medium
tags:
  - attack.t1068
  - cve.2026.98384

YARA Rule

rule CVE_2026_98384_BPF_ITER_SOCK_DESTROY
{
    meta:
        description = "Detects BPF bytecode/ELF artifacts referencing the TCP iterator and socket-destroy helper associated with CVE-2026-98384"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "CVE-2026-98384"
        severity = "medium"

    strings:
        $s1 = "iter_tcp" ascii wide
        $s2 = "iter_tcp6" ascii wide
        $s3 = "timewait" ascii wide
        $s4 = "bpf_sock_destroy" ascii wide
        $s5 = "bpf_iter" ascii wide
        $s6 = "sk_protocol" ascii wide

    condition:
        uint32(0) == 0x464c457f and
        (2 of ($s*))
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98384 Suspicious BPF TCP Iterator / Socket Destroy Activity"; flow:to_server,established; content:"iter_tcp"; nocase; content:"sock_destroy"; nocase; distance:0; within:256; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-admin; sid:202698384; rev:1;)

Elastic Detection

process where event.category == "process" and event.type == "start"
  and process.name in ("bpf", "bpftool", "test_progs", "bcc")
  and process.command_line != null
  and (
    process.command_line : "*iter_tcp*" or
    process.command_line : "*timewait*" or
    process.command_line : "*sock_destroy*" or
    process.command_line : "*iter*"
  )

Splunk SPL Query

index=linux sourcetype=auditd (syscall=bpf OR comm=test_progs OR process_name=bpftool)
| search (a0=*ITER* OR a1=*sock_destroy* OR a1=*iter_tcp* OR cmd=*iter_tcp* OR cmd=*timewait*)
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_name, a0, a1
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="linux,kernel,bpf,">
  <rule id="983840" level="8">
    <decoded_as>audit</decoded_as>
    <field name="syscall">bpf</field>
    <field name="comm">test_progs|bpf|bpftool|bcc</field>
    <description>CVE-2026-98384: Suspicious BPF iterator/socket-destroy activity detected (possible bpf_sock_destroy OOB read abuse)</description>
    <mitre>
      <id>T1068</id>
    </mitre>
  </rule>

  <rule id="983841" level="10">
    <if_sid>983840</if_sid>
    <field name="exe">bpf|bpftool|test_progs</field>
    <description>CVE-2026-98384: High-confidence BPF iterator program execution targeting TCP sockets</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version list, or workaround is present in the provided data; the guidance below is generic hardening for this class and should be validated against your distribution.

1. Immediate mitigations

   • Restrict access to BPF. Set kernel.unprivileged_bpf_disabled=1 (or =2 for a permanent lock) to prevent unprivileged users from loading BPF programs and reaching the iterator path.
   • Minimize CAP_BPF/CAP_SYS_ADMIN assignment; only trusted, root-owned tooling should be able to attach BPF_PROG_TYPE_ITER programs.
   • Where the affected iterator is not required, block or audit its use and monitor for iterator program loads (see Detection Guidance).
   • Enable KASAN only on test/hardened systems; in production, rely on kernel crash monitoring, dmesg out-of-bounds indicators, and panic-on-oops policies where availability requirements permit.

2. Patch / upgrade steps

   • Track upstream Linux kernel bpf: fixes for bpf_sock_destroy() (the change that limits the sk_protocol check to full struct sock objects). Apply the vendor kernel update from your distribution once available.
   • Because no patch hash or released version is recorded here, verify the current kernel against your vendor's advisory feed before upgrading; do not assume a specific version string.
   • Reboot into the patched kernel and confirm BPF selftests (test_progs) pass.

3. Long-term hardening

   • Adopt a regular kernel update cadence with staged rollout.
   • Enforce the principle of least privilege for anything that can load BPF programs.
   • Maintain kernel crash telemetry and enable automatic alerting on KASAN/oops signatures involving bpf_sock_destroy.
   • Reassess BPF attack surface periodically, tracking the upstream fix as authoritative for closure of this CVE.

References

• NVD — CVE-2026-98384: https://nvd.nist.gov/vuln/detail/CVE-2026-98384
• CWE-125: Out-of-bounds Read — https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1068: Exploitation for Privilege Escalation — https://attack.mitre.org/techniques/T1068/
• Linux kernel BPF documentation (BPF iterator programs and helpers) — https://www.kernel.org/doc/html/latest/bpf/
• Linux kernel mailing list / stable tree bpf: fix series for bpf_sock_destroy() (consult the kernel.org git history for the authoritative commit once published)

No public PoC, Nuclei template, or exploit code is available for this CVE. CISA KEV: not listed. No known threat actor campaigns or exploit-in-the-wild evidence were provided; no fabricated attribution is asserted.