Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to cause a system crash or leak system resources. The issue occurs when specific types of network sockets (SOCKMAP) handle file descriptors incorrectly, leading to memory errors. This could disrupt system stability and availability for users and applications.
Technical details
A vulnerability in the Linux kernel's AF_UNIX implementation involves the interaction between SOCKMAP and the garbage collector (GC). SOCKMAP can 'hide' inflight file descriptors from the AF_UNIX GC because the GC cannot inspect the psock ingress queue. This leads to socket leaks and breaks assumptions in the Tarjan-based GC regarding the lifecycle of unix_edge.successor. When a socket buffer (skb) is redirected via SOCKMAP, it can result in a use-after-free in unix_del_edges. The fix involves dropping all SCM (Socket Control Message) attributes before passing the skb to the SOCKMAP layer. Patches have been released in the stable kernel tree.
Affected products
- Linux Linux Kernel 7.0.0-rc7-00263-gb9d8b856689d
Timeline
- 2026-04-15: patched: Initial patch authored by Kuniyuki Iwashima
- 2026-06-24: disclosed: CVE-2026-53005 published