CVE-2026-53005

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> af_unix: Drop all SCM attributes for SOCKMAP.<br /> <br /> SOCKMAP can hide inflight fd from AF_UNIX GC.<br /> <br /> When a socket in SOCKMAP receives skb with inflight fd,<br /> sk_psock_verdict_data_ready() looks up the mapped socket and<br /> enqueue skb to its psock-&gt;ingress_skb.<br /> <br /> Since neither the old nor the new GC can inspect the psock<br /> queue, the hidden skb leaks the inflight sockets. Note that<br /> this cannot be detected via kmemleak because inflight sockets<br /> are linked to a global list.<br /> <br /> In addition, SOCKMAP redirect breaks the Tarjan-based GC&amp;#39;s<br /> assumption that unix_edge.successor is always alive, which<br /> is no longer true once skb is redirected, resulting in<br /> use-after-free below. [0]<br /> <br /> Moreover, SOCKMAP does not call scm_stat_del() properly,<br /> so unix_show_fdinfo() could report an incorrect fd count.<br /> <br /> sk_msg_recvmsg() does not support any SCM attributes in the<br /> first place.<br /> <br /> Let&amp;#39;s drop all SCM attributes before passing skb to the<br /> SOCKMAP layer.<br /> <br /> [0]:<br /> BUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)<br /> Read of size 8 at addr ffff888125362670 by task kworker/56:1/496<br /> <br /> CPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy)<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014<br /> Workqueue: events sk_psock_backlog<br /> Call Trace:<br /> <br /> dump_stack_lvl (lib/dump_stack.c:122)<br /> print_report (mm/kasan/report.c:379)<br /> kasan_report (mm/kasan/report.c:597)<br /> unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251)<br /> unix_destroy_fpl (net/unix/garbage.c:317)<br /> unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976)<br /> sk_psock_backlog (./include/linux/skbuff.h:?)<br /> process_scheduled_works (kernel/workqueue.c:?)<br /> worker_thread (kernel/workqueue.c:?)<br /> kthread (kernel/kthread.c:438)<br /> ret_from_fork (arch/x86/kernel/process.c:164)<br /> ret_from_fork_asm (arch/x86/entry/entry_64.S:258)<br /> <br /> <br /> Allocated by task 955:<br /> kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)<br /> __kasan_slab_alloc (mm/kasan/common.c:369)<br /> kmem_cache_alloc_noprof (mm/slub.c:4539)<br /> sk_prot_alloc (net/core/sock.c:2240)<br /> sk_alloc (net/core/sock.c:2301)<br /> unix_create1 (net/unix/af_unix.c:1099)<br /> unix_create (net/unix/af_unix.c:1169)<br /> __sock_create (net/socket.c:1606)<br /> __sys_socketpair (net/socket.c:1811)<br /> __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:?)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)<br /> <br /> Freed by task 496:<br /> kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78)<br /> kasan_save_free_info (mm/kasan/generic.c:587)<br /> __kasan_slab_free (mm/kasan/common.c:287)<br /> kmem_cache_free (mm/slub.c:6165)<br /> __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384)<br /> sk_psock_destroy (./include/net/sock.h:?)<br /> process_scheduled_works (kernel/workqueue.c:?)<br /> worker_thread (kernel/workqueue.c:?)<br /> kthread (kernel/kthread.c:438)<br /> ret_from_fork (arch/x86/kernel/process.c:164)<br /> ret_from_fork_asm (arch/x86/entry/entry_64.S:258)