{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-80521", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.763Z", "datePublished": "2026-08-26T14:37:02.589Z", "dateUpdated": "2026-10-03T10:56:06.656Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:56:06.656Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n 1) Create two SCCs:\n\n X -. A <-> B\n ^--'\n\n 2) Run the following concurrently:\n\n 2-1) send() sk-B to sk-B from sk-X\n 2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B <-> B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A <-> B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B <-> B edge.\n\n X -. A <-> B -. This edge is visible\n ^--' ^..' but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n X -. A <.> B -.\n ^--' ^--'\n\nHowever, X's SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B's scc_entry.\n\nLet's unlink scc_entry before freeing the vertex in unix_del_edge()." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is only reachable through local AF_UNIX syscalls (socket/sendmsg with SCM_RIGHTS and close) that drive unix_add_edges(), unix_del_edge(), and unix_gc(); AF_UNIX is host-local IPC with no remote packet, Bluetooth, WiFi, or physical bus entry path.\nAC:L - Exploitation requires racing sendmsg() (scm_stat_add/unix_add_edges before skb_queue_tail) against concurrent close() that triggers GC; the attacker controls both threads, can pin CPUs, and can retry until the window is hit, so success does not depend on conditions outside attacker control.\nPR:L - An unprivileged local user can create AF_UNIX sockets, pass socket file descriptors via SCM_RIGHTS to form inflight reference cycles, and close sockets to schedule unix_gc(); no real-root capabilities, special namespaces, or non-default kernel configuration are required.\nUI:N - The attacker sets up the cyclic inflight graph, performs the concurrent self-send and close operations, and forces garbage collection from its own processes; no separate victim user action or cooperating peer is needed beyond the attacker's own sockets.\nS:U - The use-after-free corrupts kernel heap/list state during AF_UNIX garbage collection within the same kernel security authority; exploitation yields standard local privilege escalation rather than crossing a VM, IOMMU, or inter-tenant sandbox boundary.\nC:H - Freed struct unix_vertex objects remain linked through stale scc_entry; unix_walk_scc_fast(), unix_scc_dead(), and unix_collect_skb() dereference freed vertex->edges and predecessor socket receive queues, giving a slab UAF read primitive controllable through heap grooming.\nI:H - The same UAF enables reclaiming freed vertices and influencing GC list iteration and skb_queue_splice_init() during unix_collect_skb(), providing memory corruption primitives suitable for arbitrary kernel writes, control-flow hijack, and local privilege escalation.\nA:H - Iterating or collecting through a freed vertex reliably triggers kernel oops/panic (KASAN slab-use-after-free), and corrupt GC graph state can crash the host or deny service to local workloads even when full exploitation is not attempted." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/unix/garbage.c" ], "versions": [ { "version": "5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a", "lessThan": "2b6c2842692d08e7acaf32d1eb47f95def35f3fe", "status": "affected", "versionType": "git" }, { "version": "de7921631ff323369aa63a4324695ab54ea4047e", "lessThan": "6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33", "status": "affected", "versionType": "git" }, { "version": "4090fa373f0e763c43610853d2774b5979915959", "lessThan": "1293fd69a50d188a5788b08ba3741a3e86be1608", "status": "affected", "versionType": "git" }, { "version": "4090fa373f0e763c43610853d2774b5979915959", "lessThan": "fe198b077864feafd4aa4b33b1a5ce26f50195a2", "status": "affected", "versionType": "git" }, { "version": "4090fa373f0e763c43610853d2774b5979915959", "lessThan": "e3702470ced94fad74d71e2232f022d2eb752a6d", "status": "affected", "versionType": "git" }, { "version": "4090fa373f0e763c43610853d2774b5979915959", "lessThan": "594d905195024b228c962627ae5ae7c17bd582a4", "status": "affected", "versionType": "git" }, { "version": "6.1.141", "lessThan": "6.1.189", "status": "affected", "versionType": "semver" }, { "version": "6.6.93", "lessThan": "6.6.158", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/unix/garbage.c" ], "versions": [ { "version": "6.10", "status": "affected" }, { "version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.141", "versionEndExcluding": "6.1.189" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.93", "versionEndExcluding": "6.6.158" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.111" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.53" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1.10" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.2" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/2b6c2842692d08e7acaf32d1eb47f95def35f3fe" }, { "url": "https://git.kernel.org/stable/c/6fda5c51b8e43a8440f76e65c89d9f95ddb2ef33" }, { "url": "https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608" }, { "url": "https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2" }, { "url": "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d" }, { "url": "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4" } ], "title": "af_unix: Unlink scc_entry in unix_del_edge().", "x_generator": { "engine": "bippy-1.2.0" } } } }