Junglewise Threat Intelligence

CVE-2026-52928: Linux Kernel improper SIOCATMARK handling in AF_UNIX sockets

CVE-2026-52928 · Severity: info · CVSS 0 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's handling of Unix domain sockets. The system incorrectly allowed certain status queries (SIOCATMARK) on socket types that do not support 'out-of-band' urgent data. While primarily a logic error, this could lead to unexpected behavior in applications relying on precise network socket states.

Technical details

A logic error in net/unix/af_unix.c allowed the SIOCATMARK ioctl to be processed for SOCK_DGRAM and SOCK_SEQPACKET socket types. In the AF_UNIX family, out-of-band (MSG_OOB) data is only supported for SOCK_STREAM. Because the other socket types reject MSG_OOB in send/receive operations, they should also reject SIOCATMARK. The fix introduces a check in unix_ioctl to return -EOPNOTSUPP for non-stream sockets before accessing the receive queue. This prevents potential undefined behavior or incorrect state reporting for local inter-process communication.

Affected products

  • Linux Linux Kernel 5.15 to 6.12.88, 6.18.30, 7.0.7

Timeline

  • 2026-05-06: other: Patch submitted by Jiexun Wang
  • 2026-06-24: disclosed: CVE published

References

Related threats