Executive brief
A vulnerability was identified in the Linux kernel's networking component that handles local communication between processes (AF_UNIX sockets). Under specific conditions where two programs are reading from the same communication channel simultaneously, the system may attempt to access memory that has already been cleared. This could lead to a system crash or potentially allow an attacker to gain unauthorized access to sensitive information or escalate their privileges on the system.
Technical details
A use-after-free (UAF) vulnerability exists in unix_stream_data_wait() within the AF_UNIX implementation. The function performs an skb_peek_tail() on the receive queue without adequate locking, allowing a concurrent process to dequeue and free the socket buffer (SKB) before it is dereferenced. Specifically, the code dereferences tail->len after the SKB may have been consumed by a racing recv() call. This issue was introduced by the implementation of splice support for AF_UNIX stream sockets. The fix involves removing the unnecessary length check, as SKBs in these queues no longer grow in size in modern kernel versions (6.5+). Local access is required to exploit this race condition.
Affected products
- Linux Linux Kernel 6.5 and later
Timeline
- 2026-05-18: other: Patch submitted by Jann Horn
- 2026-06-19: patched: Commits merged into stable trees
- 2026-07-19: disclosed: CVE published in NVD
References
- https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623
- https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e
- https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f
- https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63
- https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719