Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a system crash or potentially access sensitive kernel memory. The issue occurs when the system retrieves diagnostic information about local communication sockets (AF_UNIX) while those sockets are being closed. This race condition impacts the stability and security of the operating system.
Technical details
A race condition exists in net/unix/diag.c within the Linux kernel's af_unix implementation. Exact UNIX diag lookups hold a reference to the socket but fail to maintain a reference to the socket path (u->path). Simultaneously, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. If a diagnostic query occurs during this window, it may attempt to access the inode and device numbers of a dentry that is being freed. The fix involves moving the retrieval of UNIX_DIAG_VFS data (inode and device numbers) inside the unix_state_lock() critical section to ensure data stability. This is a local vulnerability requiring low privileges with no user interaction.
Affected products
- Linux Linux Kernel 3.3 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-07: other: Patch authored
- 2026-04-25: disclosed: Initial disclosure date
- 2026-04-25: advisory
- 2026-06-01: patched: Final updates to stable branches documented
References
- https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8
- https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef
- https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7
- https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9
- https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c
- https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0
- https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b