CVE-2026-31673

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> af_unix: read UNIX_DIAG_VFS data under unix_state_lock<br /> <br /> Exact UNIX diag lookups hold a reference to the socket, but not to<br /> u-&gt;path. Meanwhile, unix_release_sock() clears u-&gt;path under<br /> unix_state_lock() and drops the path reference after unlocking.<br /> <br /> Read the inode and device numbers for UNIX_DIAG_VFS while holding<br /> unix_state_lock(), then emit the netlink attribute after dropping the<br /> lock.<br /> <br /> This keeps the VFS data stable while the reply is being built.