bpf_ksock_create(9)

💖 bpf_ksock_create(9) 💖

okay so bestie, welcome to the Kernel API Manual for bpf_ksock_create(9) — yes we're reading kernel docs together, this is our bonding time now 🫶

---

✨ NAME ✨

bpf_ksock_create — the one that creates a BPF kernel socket, no cap 🧚

---

✨ SYNOPSIS ✨

__bpf_kfunc struct bpf_ksock * bpf_ksock_create (const struct
bpf_ksock_create_opts *opts , u32 opts__sz , int *err__uninit );

like, look at that signature. iconic behavior honestly 👑

---

✨ ARGUMENTS ✨

• opts — pointer to a struct bpf_ksock_create_opts holding all the socket parameters. it's giving "here's my whole configuration bestie" 💅
• opts__sz — the size of the opts struct, a u32. yes you gotta tell it how big your struct is, standard stuff 🎀
• err__uninit — an integer where the error code gets stashed whenever NULL is returned. so like, if it hands you back nothing, check here for the tea 😭

---

✨ DESCRIPTION ✨

so what it does is allocate and create a kernel socket. literally the whole vibe ✨

the context you get back must either be:

• stored in a map as a kptr, or
• freed with bpf_ksock_release

no third option, no "i'll deal with it later" — those are the only two paths periodt 💀

⚠️ heads up bestie: this function may sleep (sock_create), which means it can only be used in sleepable BPF programs (SYSCALL). and nope, you cannot call it from a BPF workqueue callback, because that callback does not retain the invoking task's namespace or security context. so like, don't even try it 🙈

---

✨ SEE ALSO ✨

go check out the kernel file ./net/core/bpf_ksock.c and these besties:

• struct bpf_ksock(9)
• bpf_ksock_connect(9)
• bpf_ksock_acquire(9)
• bpf_ksock_release(9)
• bpf_ksock_send(9)

they're all in the group chat, fr fr 🌸

---

k bye ily, this page lives in ./net/core, dated October 2026, and it's from the Kernel API Manual — go read the source, it ate 💖✨🎀🦋