{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31673", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.130Z", "datePublished": "2026-04-25T08:46:49.246Z", "dateUpdated": "2026-08-05T12:24:20.351Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:24:20.351Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu->path. Meanwhile, unix_release_sock() clears u->path under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached through local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY requests for AF_UNIX diagnostics. It is not reachable from remote network packets; an attacker needs local code execution to create sockets and send netlink requests.\nAC:L - The race is attacker-controlled because one thread can repeatedly issue exact UNIX_DIAG requests with UDIAG_SHOW_VFS while another closes attacker-created pathname AF_UNIX sockets. No rare external condition is required beyond timing that can be retried.\nPR:L - Unprivileged users can create AF_UNIX sockets and NETLINK_SOCK_DIAG sockets, and the sock_diag netlink socket permits non-root diagnostic requests. No real root or init-namespace CAP_NET_ADMIN is required.\nUI:N - Exploitation does not require any victim action. The attacker can create, bind, query, unlink, and close the involved sockets directly.\nS:U - The bug is in the kernel AF_UNIX diagnostic path and impacts kernel resources within the same security authority. It is a standard local kernel vulnerability, not a VM, IOMMU, or sandbox boundary-crossing issue.\nC:H - The bug is a use-after-free/read-after-free of the AF_UNIX VFS path dentry, allowing stale kernel object pointers to be dereferenced and returned or used during netlink reply construction. Under the required kernel scoring guidance, UAFs are treated as high confidentiality impact.\nI:H - Although the immediate vulnerable operation reads VFS fields, it is a kernel use-after-free in attacker-controllable local object lifetime and race conditions. Following the required guidance and higher-severity rule, UAFs are scored as potentially enabling integrity compromise.\nA:H - The stale dentry or related VFS pointer can be dereferenced after path_put(), plausibly causing a kernel oops or panic. Repeated local triggering makes high availability impact defensible." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/unix/diag.c" ], "versions": [ { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "e7339db13b9ddb63417b12da55fd6191e59f7442", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "c3ec44ab4526bbc4b6c9fc845af86488244f4c9b", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "b9232421a77a649c9376c99fdfc8cb7f79cad34c", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "0c739f3785f84af695952c2bac8be2f45082c9b8", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "900a4e0910e98b8caef117d5df00471fa438dcf9", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "bdf206e740bf2919d818f132c8c9cc7ed91d11c0", "status": "affected", "versionType": "git" }, { "version": "5f7b0569460b7d8d01ca776430a00505a68b7584", "lessThan": "39897df386376912d561d4946499379effa1e7ef", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/unix/diag.c" ], "versions": [ { "version": "3.3", "status": "affected" }, { "version": "0", "lessThan": "3.3", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.6.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.12.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.18.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "6.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.3", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442" }, { "url": "https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7" }, { "url": "https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b" }, { "url": "https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c" }, { "url": "https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8" }, { "url": "https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9" }, { "url": "https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0" }, { "url": "https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef" } ], "title": "af_unix: read UNIX_DIAG_VFS data under unix_state_lock", "x_generator": { "engine": "bippy-1.2.0" } } } }