CVE-2026-53035

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> bpf, sockmap: Fix af_unix iter deadlock<br /> <br /> bpf_iter_unix_seq_show() may deadlock when lock_sock_fast() takes the fast<br /> path and the iter prog attempts to update a sockmap. Which ends up spinning<br /> at sock_map_update_elem()&amp;#39;s bh_lock_sock():<br /> <br /> WARNING: possible recursive locking detected<br /> test_progs/1393 is trying to acquire lock:<br /> ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: sock_map_update_elem+0xdb/0x1f0<br /> <br /> but task is already holding lock:<br /> ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0<br /> <br /> other info that might help us debug this:<br /> Possible unsafe locking scenario:<br /> <br /> CPU0<br /> ----<br /> lock(slock-AF_UNIX);<br /> lock(slock-AF_UNIX);<br /> <br /> *** DEADLOCK ***<br /> <br /> May be due to missing lock nesting notation<br /> <br /> 4 locks held by test_progs/1393:<br /> #0: ffff88814b59c790 (&amp;p-&gt;lock){+.+.}-{4:4}, at: bpf_seq_read+0x59/0x10d0<br /> #1: ffff88811ec25fd8 (sk_lock-AF_UNIX){+.+.}-{0:0}, at: bpf_seq_read+0x42c/0x10d0<br /> #2: ffff88811ec25f58 (slock-AF_UNIX){+...}-{3:3}, at: __lock_sock_fast+0x37/0xe0<br /> #3: ffffffff85a6a7c0 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x51d/0xb00<br /> <br /> Call Trace:<br /> dump_stack_lvl+0x5d/0x80<br /> print_deadlock_bug.cold+0xc0/0xce<br /> __lock_acquire+0x130f/0x2590<br /> lock_acquire+0x14e/0x2b0<br /> _raw_spin_lock+0x30/0x40<br /> sock_map_update_elem+0xdb/0x1f0<br /> bpf_prog_2d0075e5d9b721cd_dump_unix+0x55/0x4f4<br /> bpf_iter_run_prog+0x5b9/0xb00<br /> bpf_iter_unix_seq_show+0x1f7/0x2e0<br /> bpf_seq_read+0x42c/0x10d0<br /> vfs_read+0x171/0xb20<br /> ksys_read+0xff/0x200<br /> do_syscall_64+0x6b/0x3a0<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e