Description

The SOCK_STREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer. An unprivileged local user can exploit this use-after-free to escalate privileges.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T05:18:12.217Z",
  "pubdate": "2026-08-26T05:18:12.217Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw residing in the SOCK_STREAM receive path of the unix socket implementation within the kernel.\nThe issue stems from improper handling of control messages during error scenarios, resulting in the premature freeing of memory buffers while they are still referenced in the receive socket buffer.\nAn unprivileged local attacker can leverage this memory corruption to escalate privileges, potentially gaining root access to the affected system.\nSuccessful exploitation requires local access, as the vulnerability is constrained to the unix socket subsystem, which generally does not expose a remote network attack surface.\nGiven the ability to achieve arbitrary code execution or kernel state manipulation through UAF primitives, the risk to system integrity and confidentiality is considered critical.\nThis vulnerability highlights a critical failure in the lifecycle management of mbufs (memory buffers) during asynchronous socket operations, necessitating immediate kernel updates to ensure proper synchronization and memory deallocation protocols.",
  "technicalDetails": "The root cause of this vulnerability lies in the race condition or improper state management within the SOCK_STREAM receive path of the unix socket implementation. Specifically, the kernel fails to atomically detach control messages (ancillary data) from the socket buffer (sk_receive_queue) before initiating processing routines.\nIn standard operation, control messages are attached to a socket buffer and queued for the user space to retrieve via recvmsg(). However, when an error condition is encountered during the processing of these messages, certain kernel error paths invoke memory deallocation functions on the mbufs associated with these control messages without removing them from the receive queue.\nThis leads to a classic use-after-free condition. The socket buffer retains pointers to the freed memory structures. Because these memory regions are released back to the kernel slab allocator, they may be subsequently reallocated for other kernel objects. If an attacker can influence the allocator to place a controlled object—or an object containing function pointers—into the memory previously occupied by the freed control message, they can trigger a use-after-free condition.\nThe attack flow proceeds as follows: 1) An unprivileged user initializes a unix socket and sends specially crafted control messages using sendmsg() to populate the receive queue. 2) The attacker triggers a sequence of operations designed to cause an error in the receive path, forcing the kernel to free the control message while maintaining the stale pointer in the receive queue. 3) The attacker performs heap grooming or memory spraying to allocate objects that occupy the now-freed memory address. 4) The attacker triggers the use-after-free by forcing the kernel to access the stale pointer in the receive queue, effectively redirecting kernel control flow or corrupting sensitive kernel structures.\nBecause this occurs within the kernel address space, the impact is severe. By overwriting kernel data structures (such as cred structures) or hijacking control flow (such as overwriting function pointers), a local unprivileged user can elevate their process privileges to root. The vulnerability effectively bypasses traditional user-space security boundaries, as the malicious actions are executed with the full authority of the kernel environment."
}