Executive brief
A vulnerability in the Linux kernel's networking component could allow a local attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system handles specific types of high-priority data (Out-of-Band data) over local communication channels (Unix sockets). This could lead to a system instability or a security breach on multi-user systems.
Technical details
A use-after-free (UAF) vulnerability exists in net/unix/af_unix.c within the unix_stream_read_generic() function. The root cause is the improper management of 'consumed' Out-of-Band (OOB) socket buffers (skbs). When OOB data is read, the skb remains in the receive queue with a length of zero to mark the OOB boundary. If multiple OOB messages are sent and received in a specific sequence, the SO_PEEK_OFF logic fails to account for these zero-length skbs, leading to a state where a previously freed skb is accessed during subsequent read operations. An attacker with local shell access can exploit this by sending crafted OOB data sequences over a Unix stream socket. Patches have been released for various stable kernel branches to ensure consecutive consumed OOB skbs are properly freed.
Affected products
- Linux Linux Kernel 6.7 to 6.12.36, 6.16-rc1
Timeline
- 2025-06-18: patched: Initial patch authored by Kuniyuki Iwashima
- 2025-07-08: disclosed: CVE published
- 2025-10-02: patched: Patch applied to stable trees
References
- https://git.kernel.org/stable/c/32ca245464e1479bfea8592b9db227fdc1641705
- https://git.kernel.org/stable/c/523edfed4f68b7794d85b9ac828c5f8f4442e4c5
- https://git.kernel.org/stable/c/61a9ad7b69ce688697e5f63332f03e17725353bc
- https://git.kernel.org/stable/c/8db4d2d026e6e3649832bfe23b96c4acff0756db
- https://git.kernel.org/stable/c/a12237865b48a73183df252029ff5065d73d305e
- https://git.kernel.org/stable/c/fad0a2c16062ac7c606b93166a7ce9d265bab976
- https://project-zero.issues.chromium.org/issues/423023990