Executive brief
The Linux kernel's Unix domain socket garbage collector can fail to properly clean up socket structures in rare concurrent scenarios, potentially leaving freed memory still referenced by internal data structures. An attacker could trigger this condition by creating specific socket configurations and performing concurrent operations, leading to a crash or potential privilege escalation.
Technical details
The vulnerability exists in the af_unix garbage collection code (net/unix/garbage.c). When the GC runs to reclaim unreferenced socket structures, a race condition can occur: if unix_add_edges() publishes a new edge between sockets but the associated skb has not yet been queued, and socket closure happens concurrently, the GC may partially free an SCC (strongly connected component) vertex. The vertex's scc_entry is not unlinked before the vertex is moved to the free list, leaving it still referenced in the SCC tracking structure. Subsequent GC iterations that walk the SCC list via unix_walk_scc_fast() will encounter and operate on the freed vertex, causing a use-after-free. The fix adds list_del(&vertex->scc_entry) before freeing the vertex in unix_del_edge().
Affected products
- Linux Linux kernel All versions with the af_unix garbage collection algorithm (since commit 4090fa373f0e); fixed in mainline and stable trees
Timeline
- 2026-08-04: disclosed: Reported by Kyle Zeng
- 2026-08-06: patched: Mainline fix committed (594d905195024b228c962627ae5ae7c17bd582a4)
- 2026-09-21: patched: Backport to stable kernels (1293fd69a50d188a5788b08ba3741a3e86be1608)