Executive brief
A vulnerability was identified in the Linux kernel's handling of Unix domain sockets. The system incorrectly allowed certain status queries (SIOCATMARK) on socket types that do not support 'out-of-band' urgent data. While primarily a logic error, this could lead to unexpected behavior in applications relying on precise network socket states.
Technical details
A logic error in net/unix/af_unix.c allowed the SIOCATMARK ioctl to be processed for SOCK_DGRAM and SOCK_SEQPACKET socket types. In the AF_UNIX family, out-of-band (MSG_OOB) data is only supported for SOCK_STREAM. Because the other socket types reject MSG_OOB in send/receive operations, they should also reject SIOCATMARK. The fix introduces a check in unix_ioctl to return -EOPNOTSUPP for non-stream sockets before accessing the receive queue. This prevents potential undefined behavior or incorrect state reporting for local inter-process communication.
Affected products
- Linux Linux Kernel 5.15 to 6.12.88, 6.18.30, 7.0.7
Timeline
- 2026-05-06: other: Patch submitted by Jiexun Wang
- 2026-06-24: disclosed: CVE published