Description

In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-26T15:17:05.677Z",
  "pubdate": "2026-08-26T15:17:05.677Z",
  "executiveSummary": "The Linux kernel AF_UNIX implementation contains a vulnerability involving the garbage collector's handling of Strongly Connected Components (SCCs).\nThe issue is a race condition where a dead SCC can be partially freed due to a mismatch between edge visibility and SKB queue status during concurrent send() and close() operations.\nThis vulnerability may allow an attacker to trigger inconsistent states in the AF_UNIX garbage collector, potentially leading to a Use-After-Free condition or kernel memory corruption.\nThe vulnerability affects local processes interacting with UNIX domain sockets; successful exploitation typically requires the ability to create specific socket topologies and trigger concurrent I/O operations.\nRisk implications include potential system instability, kernel panics, or privilege escalation if the memory corruption is successfully controlled.",
  "technicalDetails": "The vulnerability resides within the AF_UNIX garbage collection (GC) mechanism, specifically within the logic that manages SCCs (Strongly Connected Components) and their associated metadata entries.\nThe root cause is a race condition in unix_add_edges() where an edge (e.g., B <-> B) is published to the GC visibility list before the corresponding skb is actually queued via skb_queue_tail().\nDuring concurrent execution of send() and close() on linked UNIX sockets, a temporal window exists where the GC observes a new edge while the SKB itself remains unqueued and unreachable by standard collection logic.\nWhen close() operations are executed concurrently with the insertion, the GC may miscalculate the state of the SCC, marking nodes as dead while failing to free them because the associated SKBs are not yet fully integrated into the queue.\nThe failure occurs because the GC subsequently performs a walk of the SCC via unix_walk_scc_fast(), which iterates over a stale or partially freed scc_entry list.\nBecause unix_del_edge() did not explicitly unlink the scc_entry before the vertex was freed, the GC traversal logic encounters dangling pointers or corrupted list structures during subsequent passes.\nAn attacker can exploit this by crafting a specific socket topology (as described in the SCC example X -. A <-> B) to force the GC into a state where it attempts to re-process an improperly cleaned-up SCC.\nThe post-exploitation impact includes memory corruption within the kernel's slab allocator, potentially leading to arbitrary code execution or a kernel oops resulting in denial of service.\nThe vulnerability is localized to the kernel's network subsystem, specifically the UNIX domain socket GC, requiring local user privileges to initialize the socket connections and perform the race-inducing syscalls."
}