Junglewise Threat Intelligence

CVE-2026-23394: Linux Kernel race condition in af_unix garbage collection

CVE-2026-23394 · Severity: medium · CVSS 4.7 · Published 2026-03-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition in the Linux kernel's networking subsystem could allow a local user to cause a system malfunction. Specifically, the garbage collection process for Unix domain sockets may incorrectly delete active data if a 'peek' operation occurs at the same time a socket is being closed. This can lead to the unexpected loss of network data or socket instability.

Technical details

A race condition exists in the af_unix garbage collector (GC) when interacting with the MSG_PEEK flag. The root cause is that MSG_PEEK increments a file reference count without notifying the GC. If a socket is closed while another thread is performing a MSG_PEEK on a related socket within the same Strongly Connected Component (SCC), the GC may miscalculate reference counts and incorrectly conclude that active sockets are 'dead.' This results in the GC purging the receive queues of alive sockets. The fix introduces a seqcount_t barrier to notify the GC when a MSG_PEEK occurs, causing it to defer garbage collection for that component to a later run.

Affected products

  • Linux Linux Kernel 6.1.141, 6.6.93, 6.10.1, 6.19, 7.0-rc1

Timeline

  • 2026-03-11: other: Patch submitted by developer
  • 2026-03-25: disclosed: Vulnerability published
  • 2026-03-25: patched: Fixes merged into stable branches

References