Executive brief
A vulnerability in the Linux kernel's networking component could allow a local attacker to crash the system. The issue occurs when the system incorrectly handles internal communication sockets (AF_UNIX) during specific BPF program updates. This results in a system 'kernel panic' or crash, impacting the availability of the server or device.
Technical details
A race condition exists in the Linux kernel between unix_stream_connect() and BPF sockmap updates (unix_stream_bpf_update_proto). The function unix_stream_connect() sets the socket state to TCP_ESTABLISHED before assigning a peer socket via unix_peer(sk). If a BPF program or system call attempts to update the sockmap during this window, sock_map_sk_state_allowed() incorrectly validates the socket as fully connected. This leads to a NULL pointer dereference when the kernel attempts to access the unassigned peer socket. The fix introduces a NULL check in unix_stream_bpf_update_proto() to ensure the peer is assigned before proceeding with the protocol update.
Affected products
- Linux Linux Kernel 6.10, 6.9, 6.6, 6.1, 5.15, 5.10
Timeline
- 2026-04-14: other: Patch authored
- 2026-05-23: patched: Patch committed to stable tree
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/041eb6348d73ee5e15fc8161f1eac5a6e8289ca0
- https://git.kernel.org/stable/c/37bfcd164161b47d00b1c3bd20adc816a6977ce0
- https://git.kernel.org/stable/c/4913c94a3adcdbb64c552110c0c243cb1fdbb317
- https://git.kernel.org/stable/c/75b7d3b3f8bd4e59eb3af1b11a43c64c0c2db6f4
- https://git.kernel.org/stable/c/a94d3dd78ee8b63e6b8ad629081c952c93ee5a10
- https://git.kernel.org/stable/c/dca38b7734d2ea00af4818ff3ae836fab33d5d5a