skb_steal_sock(9)

💅 skb_steal_sock(9) — from the Kernel API Manual, bestie 🎀

Okay so picture this: it's giving "kernel networking" and you've got an sk_buff and you want the socket that's chilling inside it. This function is literally the little goblin that yoinks it out for you. The manual name is skb_steal_sock, and yeah, it's exactly as iconic as it sounds ✨

---

🌸 NAME 🌸

skb_steal_sock — steal a socket from an sk_buff 🫶

---

✨ SYNOPSIS ✨

struct sock * skb_steal_sock (struct sk_buff *skb , bool *refcounted ,
bool *prefetched );

Three args, one socket, zero regrets. Copy it exactly like that, no cap 💅

---

🦋 ARGUMENTS 🦋

• skb — the sk_buff you're stealing the socket from. This is the victim, bestie 😭
• refcounted — gets set to true if the socket is reference-counted. So it's a bool *, meaning you hand over the address and the function writes the answer in there for you 🧚
• prefetched — gets set to true if the socket was assigned from bpf. That's it, that's the vibe ⭐

---

👑 SEE ALSO 👑

• Kernel file ./include/net/request_sock.h — go read it, iykyk 📖

---

lowkey reminder: refcounted and prefetched are both bool *, so pass pointers, not values. the function fills them in for you, and that's the whole point of them being there 🙈

---

and that's the page, bestie 🌈 sourced from ./include/net, dated October 2026, still filed under skb_steal_sock(9) — mwah, go steal some sockets responsibly 💖🎀