bad_garbage

BADGARBAGE.c CVE-2026-53361 — an unprivileged, container-escapable use-after-free in the AFUNIX socket garbage collector. This is the single-vector MSGPEEK only version. The Bug The AFUNIX GC reclaims "in-flight" sockets that form unreachable reference cycles. A concurrent MSGPEEK on an in-flight...

CVE-2024-27815

CVE-2024-27815 XNU kernel heap buffer overflow in sbconcatmbufs bsd/kern/uipcsocket2.c, reachable by an unprivileged local user over the AFUNIX datagram socket layer. A socket address of up to SOCKMAXADDRLEN 255 bytes is copied into an mbuf data area only MLEN 224 bytes long, overwriting up to 31...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31673)

In the Linux kernel, the following vulnerability has been resolved: afunix: read UNIXDIAGVFS data under unixstatelock Exact UNIX diag lookups hold a reference to the socket, but not to u-path. Meanwhile, unixreleasesock clears u-path under unixstatelock and drops the path reference after unlockin...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-52928)

In the Linux kernel, the following vulnerability has been resolved: afunix: Reject SIOCATMARK on non-stream sockets SIOCATMARK reports whether the receive queue is at the urgent mark for MSGOOB. In AFUNIX, MSGOOB is supported only for SOCKSTREAM sockets. SOCKDGRAM and SOCKSEQPACKET reject MSGOOB ...

Unity Linux 20.1070e Security Update: kernel (UTSA-2026-131748)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-131748 advisory. In the Linux kernel, the following vulnerability has been resolved: net: do not sense pfmemalloc status in skbappendpagefrags skbappendpagefrags is used by afunix an...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: afunix: Do not use GC if MSGPEEK occurred. Igor Ushakov reported that GC purged the receive queue of a live socket due to a race with MSGPEEK, with a fix provided. This is exactly the same issue that was previously fixed in the...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf, sockmap: Fixed the deadlock caused by afunix iter The bpfiterunixseqshow function may cause a deadlock when locksockfast uses the fast path, and the iter function attempts to update sockmap. This results in a deadlock at...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: afunix: Fixed data races related to user-unixinflight. user-unixinflight is updated under spinlockunixgclock, but toomanyunixfds reads it without locking. Let’s annotate the write/read accesses to user-unixinflight. BUG: KCSAN...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: afunix: Reading UNIXDIAGVFS data under unixstatelock The exact UNIX diag lookups refer to the socket, but not to u-path. Meanwhile, unixreleasesock clears u-path during unixstatelock, and drops the path reference after unlocking...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: iouring/afunix: disabling the sending of iouring via sockets File reference cycles have caused many problems for iouring in the past. It still doesn’t work correctly, and it causes races with unixstreamreadgeneric. The safest...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: afunix: Fixed a data race in unixdgrampeerwakeme. unixdgrampoll calls unixdgrampeerwakeme without ensuring that the other lock is held, and without checking whether the receive queue is full. In this case, we need to use...

SUSE CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394

A flaw was found in the Linux kernel's UNIX domain socket afunix implementation. When a blocking receive operation is performed using a zero-length buffer and the peek flag on a socket where the last queued message contains out-of-band OOB data, the kernel fails to return properly. A local attack...

UBUNTU-CVE-2026-109969

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...

CVE-2026-109969

A flaw was found in the clevis PKCS11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AFUNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary...

AZL-108119 CVE-2026-98394 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

DEBIAN-CVE-2026-98394

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394

The Linux kernel contains a vulnerability in af_unix where recv(0, MSG_PEEK) triggers a busy-wait in unix_stream_read_generic(). This occurs when a blocking recv() is called and the final socket buffer (skb) in the queue is an MSG_OOB skb, but manage_oob() returns NULL for a 0-length buffer. The ...