Skip to content
Fencer Vulns
high 7.8

CVE-2026-53005 json

af_unix: Drop all SCM attributes for SOCKMAP.

published 2026-06-24 4 mo ago modified 2026-10-19 20 d ago also EUVD-2026-38873

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.1%
EPSS 0.1% chance of exploitation in 30 days, percentile 3%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Drop all SCM attributes for SOCKMAP.

SOCKMAP can hide inflight fd from AF_UNIX GC.

When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb.

Since neither the old nor the new GC can inspect the psock queue, the hidden skb leaks the inflight sockets. Note that this cannot be detected via kmemleak because inflight sockets are linked to a global list.

In addition, SOCKMAP redirect breaks the Tarjan-based GC's assumption that unix_edge.successor is always alive, which is no longer true once skb is redirected, resulting in use-after-free below. [0]

Moreover, SOCKMAP does not call scm_stat_del() properly, so unix_show_fdinfo() could report an incorrect fd count.

sk_msg_recvmsg() does not support any SCM attributes in the first place.

Let's drop all SCM attributes before passing skb to the SOCKMAP layer.

[0]: BUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) Read of size 8 at addr ffff888125362670 by task kworker/56:1/496

CPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: events sk_psock_backlog Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379) kasan_report (mm/kasan/report.c:597) unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) unix_destroy_fpl (net/unix/garbage.c:317) unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976) sk_psock_backlog (./include/linux/skbuff.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258) </TASK>

Allocated by task 955: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) __kasan_slab_alloc (mm/kasan/common.c:369) kmem_cache_alloc_noprof (mm/slub.c:4539) sk_prot_alloc (net/core/sock.c:2240) sk_alloc (net/core/sock.c:2301) unix_create1 (net/unix/af_unix.c:1099) unix_create (net/unix/af_unix.c:1169) __sock_create (net/socket.c:1606) __sys_socketpair (net/socket.c:1811) __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860) do_syscall_64 (arch/x86/entry/syscall_64.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)

Freed by task 496: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kmem_cache_free (mm/slub.c:6165) __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384) sk_psock_destroy (./include/net/sock.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258)

Patch / fix

  • Linux Linux 6.1.189, 6.6.158, 6.12.97, 6.18.40, 7.0.10, 7.1
  • linux Debian 12 6.1.190-1
  • linux Debian 13 6.12.100-1
  • linux Debian 14 7.0.10-1
  • linux-6.12 Debian 12 6.12.100-1~deb12u1

debian advisories DEBIAN-CVE-2026-53005

  • linux Ubuntu 24.04 LTS 6.8.0-147.147
  • linux Ubuntu 26.04 LTS 7.0.0-28.28
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1067.70
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1009.9
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1071.79
  • linux-gcp Ubuntu 26.04 LTS 7.0.0-1008.8
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1066.74
  • linux-gke Ubuntu 26.04 LTS 7.0.0-1003.4

ubuntu advisories UBUNTU-CVE-2026-53005

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel RHEL 10.2 6.12.0-211.60.1.el10_2
  • rv RHEL 10.2 6.12.0-211.60.1.el10_2
  • perf RHEL 10.2 6.12.0-211.60.1.el10_2
  • rtla RHEL 10.2 6.12.0-211.60.1.el10_2
  • libperf RHEL 10.2 6.12.0-211.60.1.el10_2
  • kernel-rt RHEL 10.2 6.12.0-211.60.1.el10_2
  • kernel-64k RHEL 10.2 6.12.0-211.60.1.el10_2
  • kernel-core RHEL 10.2 6.12.0-211.60.1.el10_2

red hat advisories RHSA-2026:71602RHSA-2026:71232

  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.37.1
  • kernel-rt Linux Micro 6.2 6.12.0-160000.37.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.37.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.37.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.37.1.160000.2.19
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.37.1
  • kernel-azure SLES 16.0, SLES for SAP applications 16.0 6.12.0-160000.37.1
  • kernel-obs-qa SLES 16.0, SLES for SAP applications 16.0 6.12.0-160000.37.1

suse advisories SUSE-SU-2026:23237-1SUSE-SU-2026:23068-1SUSE-SU-2026:23221-1SUSE-SU-2026:23231-1SUSE-SU-2026:23066-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.37.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.37.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.37.1

opensuse advisories openSUSE-SU-2026:21555-1

  • kernel AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-64k AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-core AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-64k-core AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-debug-core AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-64k-modules AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-debug-modules AlmaLinux 9 5.14.0-687.51.1.el9_8
  • kernel-64k-debug-core AlmaLinux 9 5.14.0-687.51.1.el9_8

almalinux advisories ALSA-2026:71232ALSA-2026:71602

  • kernel Rocky Linux 10 6.12.0-211.60.1.el10_2
  • kernel Rocky Linux 9 5.14.0-687.51.1.el9_8

rocky linux advisories RLSA-2026:71602RLSA-2026:71232

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-53005 updated cvss 7.0

kernel: af_unix: Drop all SCM attributes for SOCKMAP

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 9 kernel-rt, kernel-rt-kvm, kernel-rt-core, kernel-rt-modules, kernel-rt-debug-kvm, kernel-rt-debug-core, +12 more
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 9) rv 5.14.0-687.51.1.el9_8, perf 5.14.0-687.51.1.el9_8, rtla 5.14.0-687.51.1.el9_8, python3-perf 5.14.0-687.51.1.el9_8, kernel-devel-matched 5.14.0-687.51.1.el9_8, kernel-64k-devel-matched 5.14.0-687.51.1.el9_8, +7 more
    fixed: vendor fix RHSA-2026:71232
  • Red Hat Enterprise Linux AppStream (v. 10) rv 6.12.0-211.60.1.el10_2, perf 6.12.0-211.60.1.el10_2, rtla 6.12.0-211.60.1.el10_2, python3-perf 6.12.0-211.60.1.el10_2, kernel-devel-matched 6.12.0-211.60.1.el10_2, kernel-64k-devel-matched 6.12.0-211.60.1.el10_2, +7 more
    fixed: vendor fix RHSA-2026:71602
  • Red Hat Enterprise Linux BaseOS (v. 9) kernel 5.14.0-687.51.1.el9_8, kernel-64k 5.14.0-687.51.1.el9_8, kernel-core 5.14.0-687.51.1.el9_8, kernel-tools 5.14.0-687.51.1.el9_8, kernel-modules 5.14.0-687.51.1.el9_8, kernel-64k-core 5.14.0-687.51.1.el9_8, +27 more
    fixed: vendor fix RHSA-2026:71232
  • Red Hat Enterprise Linux BaseOS (v. 10) kernel 6.12.0-211.60.1.el10_2, kernel-64k 6.12.0-211.60.1.el10_2, kernel-core 6.12.0-211.60.1.el10_2, kernel-tools 6.12.0-211.60.1.el10_2, kernel-modules 6.12.0-211.60.1.el10_2, kernel-64k-core 6.12.0-211.60.1.el10_2, +28 more
    fixed: vendor fix RHSA-2026:71602
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) libperf 5.14.0-687.51.1.el9_8, kernel-debuginfo-common-s390x 5.14.0-687.51.1.el9_8, kernel-debuginfo-common-x86_64 5.14.0-687.51.1.el9_8, kernel-debuginfo-common-aarch64 5.14.0-687.51.1.el9_8, kernel-debuginfo-common-ppc64le 5.14.0-687.51.1.el9_8
    fixed: vendor fix RHSA-2026:71232
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) libperf 6.12.0-211.60.1.el10_2, kernel-debuginfo-common-s390x 6.12.0-211.60.1.el10_2, kernel-debuginfo-common-x86_64 6.12.0-211.60.1.el10_2, kernel-debuginfo-common-aarch64 6.12.0-211.60.1.el10_2, kernel-debuginfo-common-ppc64le 6.12.0-211.60.1.el10_2
    fixed: vendor fix RHSA-2026:71602
show 5 more
  • Red Hat Enterprise Linux Real Time (v. 9) kernel-rt 5.14.0-687.51.1.el9_8, kernel-rt-64k 5.14.0-687.51.1.el9_8, kernel-rt-core 5.14.0-687.51.1.el9_8, kernel-rt-modules 5.14.0-687.51.1.el9_8, kernel-rt-64k-core 5.14.0-687.51.1.el9_8, kernel-rt-debug-core 5.14.0-687.51.1.el9_8, +14 more
    fixed: vendor fix RHSA-2026:71232
  • Red Hat Enterprise Linux Real Time (v. 10) kernel-rt 6.12.0-211.60.1.el10_2, kernel-rt-64k 6.12.0-211.60.1.el10_2, kernel-rt-core 6.12.0-211.60.1.el10_2, kernel-rt-modules 6.12.0-211.60.1.el10_2, kernel-rt-64k-core 6.12.0-211.60.1.el10_2, kernel-rt-debug-core 6.12.0-211.60.1.el10_2, +14 more
    fixed: vendor fix RHSA-2026:71602
  • Red Hat Enterprise Linux Real Time for NFV (v. 9) kernel-rt 5.14.0-687.51.1.el9_8, kernel-rt-core 5.14.0-687.51.1.el9_8, kernel-rt-modules 5.14.0-687.51.1.el9_8, kernel-rt-debug-core 5.14.0-687.51.1.el9_8, kernel-rt-modules-core 5.14.0-687.51.1.el9_8, kernel-rt-debug-modules 5.14.0-687.51.1.el9_8, +4 more
    fixed: vendor fix RHSA-2026:71232
  • Red Hat Enterprise Linux Real Time for NFV (v. 10) kernel-rt 6.12.0-211.60.1.el10_2, kernel-rt-core 6.12.0-211.60.1.el10_2, kernel-rt-modules 6.12.0-211.60.1.el10_2, kernel-rt-debug-core 6.12.0-211.60.1.el10_2, kernel-rt-modules-core 6.12.0-211.60.1.el10_2, kernel-rt-debug-modules 6.12.0-211.60.1.el10_2, +4 more
    fixed: vendor fix RHSA-2026:71602
  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
23 d ago

Exploit prediction

0.14% chance of exploitation in the next 30 days, higher than 3% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.