CVE-2026-23394 Linux CVE debrief

Who should care

Linux system administrators, kernel maintainers, container platform operators, and security teams running workloads with intensive AF_UNIX socket usage (e.g., D-Bus, systemd, container runtimes) where MSG_PEEK is employed and multi-threaded socket operations occur. The local attack vector and high attack complexity reduce immediate widespread risk, but availability impact could affect critical inter-process communication services.} ,

Technical summary

The vulnerability exists in the AF_UNIX socket garbage collection logic in the Linux kernel. The GC algorithm determines socket liveness by comparing file reference counts against inflight file descriptor counts. MSG_PEEK on a received file descriptor bumps the file reference count without synchronizing with GC. If close() decrements a reference count while GC is evaluating unix_vertex_dead() for sockets in a strongly connected component, GC may incorrectly conclude both sockets are dead and purge a live socket's receive queue. The fix introduces seqcount_t to signal MSG_PEEK activity to GC, causing GC to defer processing of affected SCCs to subsequent runs when a race is detected. This avoids the need for locking on the MSG_PEEK fast path while preventing erroneous collection.

Defensive priority

medium

Recommended defensive actions

• Apply the relevant stable kernel patch for your version: 6.1.x, 6.6.x, 6.10.x through 6.18.x, 6.19.x, or 7.0-rc series. Patches are available via the Linux kernel stable tree.
• Upgrade to a fixed kernel version: 6.2 or later for 6.1.x branch, 6.7 or later for 6.6.x branch, 6.18.23 or later for 6.10.x-6.18.x branch, 6.19.10 or later for 6.19.x branch, or 7.0-rc8 or later for 7.0-rc series.
• If immediate patching is not feasible, monitor for kernel Oops or unexpected socket behavior in applications heavily using AF_UNIX sockets with MSG_PEEK, particularly in multi-threaded environments with frequent socket创建
• resourceLinkAnnotations
• resourceLinkAnnotations
• resourceLinkAnnotations
• resourceLinkAnnotations
• resourceLinkAnnotations

Evidence notes

The vulnerability description explicitly states this is a reintroduction of a previously-fixed issue from commit cbcf01128d0a (af_unix: fix garbage collect vs MSG_PEEK). The race condition involves unix_vertex_dead() checks, MSG_PEEK reference count bumps, and close() reference count decrements on AF_UNIX sockets in a strongly connected component. The resolution uses seqcount_t to detect MSG_PEEK races during GC and defer collection. Multiple stable kernel patches are available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.