---
id: CVE-2023-52986
title: 'bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

  A listening socket linked to a sockmap has its sk_prot overridden. It
  points to one of the struct …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc <
    9bd6074e1872d22190a8da30e796cbf937d334f0
  - >-
    Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc <
    c681d7a4ed3d360de0574f4d6b7305a8de8dc54f
  - >-
    Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc <
    12b0ec7c6953e1602957926439e5297095d7d065
  - >-
    Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc <
    ddce1e091757d0259107c6c0c7262df201de2b66
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T20:14:08.337990Z'
published: '2025-03-27'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T20:20:53.473Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2023-52986'
references:
  - url: 'https://git.kernel.org/stable/c/9bd6074e1872d22190a8da30e796cbf937d334f0'
  - url: 'https://git.kernel.org/stable/c/c681d7a4ed3d360de0574f4d6b7305a8de8dc54f'
  - url: 'https://git.kernel.org/stable/c/12b0ec7c6953e1602957926439e5297095d7d065'
  - url: 'https://git.kernel.org/stable/c/ddce1e091757d0259107c6c0c7262df201de2b66'
tags:
  - cve.org
epss: 0.00281
epssPercentile: 0.20701
ingestedAt: '2026-11-05T22:38:31.751Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

A listening socket linked to a sockmap has its sk_prot overridden. It
points to one of the struct proto variants in tcp_bpf_prots. The variant
depends on the socket's family and which sockmap programs are attached.

A child socket cloned from a TCP listener initially inherits their sk_prot.
But before cloning is finished, we restore the child's proto to the
listener's original non-tcp_bpf_prots one. This happens in
tcp_create_openreq_child -> tcp_bpf_clone.

Today, in tcp_bpf_clone we detect if the child's proto should be restored
by checking only for the TCP_BPF_BASE proto variant. This is not
correct. The sk_prot of listening socket linked to a sockmap can point to
to any variant in tcp_bpf_prots.

If the listeners sk_prot happens to be not the TCP_BPF_BASE variant, then
the child socket unintentionally is left if the inherited sk_prot by
tcp_bpf_clone.

This leads to issues like infinite recursion on close [1], because the
child state is otherwise not set up for use with tcp_bpf_prot operations.

Adjust the check in tcp_bpf_clone to detect all of tcp_bpf_prots variants.

Note that it wouldn't be sufficient to check the socket state when
overriding the sk_prot in tcp_bpf_update_proto in order to always use the
TCP_BPF_BASE variant for listening sockets. Since commit
b8b8315e39ff ("bpf, sockmap: Remove unhash handler for BPF sockmap usage")
it is possible for a socket to transition to TCP_LISTEN state while already
linked to a sockmap, e.g. connect() -> insert into map ->
connect(AF_UNSPEC) -> listen().

[1]: https://lore.kernel.org/all/00000000000073b14905ef2e7401@google.com/

## Affected

- `Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc < 9bd6074e1872d22190a8da30e796cbf937d334f0`
- `Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc < c681d7a4ed3d360de0574f4d6b7305a8de8dc54f`
- `Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc < 12b0ec7c6953e1602957926439e5297095d7d065`
- `Linux >= e80251555f0befd1271e74b080bccf0ff0348bfc < ddce1e091757d0259107c6c0c7262df201de2b66`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.