tls Sockmap Race

Vulnerability analysis

The TLS and BPF sockmap (psock) subsystems can both attach to the same socket, and their combined interaction in the transmit path contains latent memory corruption bugs that are exploitable. The race exists because sockmap does not hold the socket lock, so there is a window where a socket can be in a sockmap and then have TLS keys configured on it, or vice versa, without either subsystem being aware of the other. The fix makes TLS and sockmap mutually exclusive by rejecting TLS key configuration on any socket that already has a psock attached; sockmap already rejected TLS sockets, so both directions of the unsafe combination are now blocked. A local user who can obtain BPF capabilities—achievable through user namespaces on many systems—can create a socket, add it to a sockmap, then attempt TLS configuration, triggering the exploitable corruption. No network packets or specific hardware are required; the attack is launched entirely through local socket operations and BPF map updates.