CVE-2026-68284

The fix for CVE-2026-68284 is correct but narrow. The vulnerability is a classic TOCTOU race: `tcp_bpf_sendmsg()` checks whether `msg_tx == psock->cork` to determine if the message is the shared cork or a local temporary, but this check occurs after `sk_stream_wait_memory()` releases and reacquires the lock. Another thread can complete and nullify `psock->cork` during the wait, causing the stale pointer to be treated as a fresh allocation and the freed cork to be double-freed. The patch switches the comparison to `msg_tx == tmp`, checking against the local variable instead of shared state, which eliminates the race. What's concerning is what the fix doesn't address. The cork mechanism encodes temporal state (batched-but-not-yet-transmitted) directly in a raw pointer, relying on NULL versus non-NULL as an implicit protocol with no formal ownership semantics. This pattern—pointer identity used as a discriminant across suspension points—may exist elsewhere in the BPF send path. Every call to `sk_stream_wait_memory()` is a potential boundary where shared state can change while a local reference remains pinned. Particularly watch the redirect path. BPF sockmap redirects via `msg_redirect_hash()` can carry corked messages across context switches with different locking semantics, potentially expanding the race window beyond the single wait call the patch addresses. Given that BPF sockmaps are increasingly deployed in production service meshes but the EPSS score remains low (0.00134), the practical exposure is growing while exploitation remains uncommon. Audit other suspension points in the BPF send path for similar pointer-identity-cross-lock-boundary patterns before the next CVE.

Reviewed through automated stages and approved by a human before publication.