Junglewise Threat Intelligence

CVE-2026-53033: Linux Kernel use-after-free in BPF sockmap af_unix iterator

CVE-2026-53033 · Severity: info · CVSS 5.5 · Published 2026-06-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A race condition was identified in the Linux kernel's networking component that could lead to a system crash. The issue occurs when specific background programs (BPF iterators) interact with Unix domain sockets while those sockets are being closed. This could allow a local attacker to cause a denial-of-service or potentially execute unauthorized actions by exploiting a 'use-after-free' memory error.

Technical details

A use-after-free (UaF) vulnerability exists in unix_stream_bpf_update_proto() due to a race condition between BPF iterator execution and socket closure. When a BPF iterator program updates a sockmap, the 'peer' pointer can become stale during a TCP_ESTABLISHED to TCP_CLOSE state transition. Specifically, while one CPU executes unix_stream_bpf_update_proto(), another CPU can release the socket via unix_release_sock(), nullifying the peer pointer and decrementing its reference count before the BPF program can acquire a reference via sock_hold(). This results in a UaF during the sock_hold() call. The fix involves taking the unix_state_lock during the af_unix iterator's seq_show operation to ensure socket stability.

Affected products

  • Linux Linux Kernel 2c860a43dd77 to c6f4015eac2e3cbc3cb7a17539e10bbb5c2049c3

Timeline

  • 2026-04-14: disclosed: Vulnerability reported and patch authored
  • 2026-05-23: patched: Patch committed to stable tree
  • 2026-06-24: advisory: CVE-2026-53033 published

References

Related threats