Linux Kernel BPF Sockmap Double Uncharge Vulnerability in Memory Management

A vulnerability in the Linux kernel's BPF sockmap implementation can lead to improper memory management. During the teardown of a socket, the memory associated with sk_msg can be double uncharged, potentially allowing for use-after-free conditions. This issue arises when tcp_bpf_sendmsg is called while a socket is being torn down, leading to sk_msg_return uncharging the message memory, followed by sk_msg_free, creating a risk of freeing memory that is still in use.

Impact

Exploitation of this vulnerability can cause memory corruption issues, such as use-after-free vulnerabilities, which could be exploited to execute arbitrary code or cause a denial-of-service condition.