CVE-2026-68399

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix UAF in sock clone early bailouts

Similar to recent commit 9b51a6155d14 ("bpf,fork: wipe ->bpf_storage

before bailouts that access it"), sk_clone() performs an initial

shallow copy of the socket field ->sk_bpf_storage via sock_copy()

for the cloned socket newsk.

If sk_clone() bails out early (e.g. if sk_filter_charge() fails) prior

to calling bpf_sk_storage_clone(), newsk->sk_bpf_storage still points

to the parent socket's BPF local storage. When newsk is subsequently

freed via sk_free(), the deallocation path (__sk_destruct() ->

bpf_sk_storage_free()) destroys the parent socket's BPF local storage,

leading to a use-after-free (UAF) on the parent socket.

Fix this by resetting newsk->sk_bpf_storage to NULL immediately after

sock_copy() in sk_clone(), and remove the now redundant initialization

from bpf_sk_storage_clone().