CVE-2026-23394 Linux CVE debrief

Who should care

Linux system administrators, kernel maintainers, container platform operators, and security teams running workloads with intensive AF_UNIX socket usage (e.g., D-Bus, systemd, container runtimes) where MSG_PEEK is employed and multi-threaded socket operations occur. The local attack vector and high attack complexity reduce immediate widespread risk, but availability impact could affect critical inter-process communication services.} ,

Technical summary

The vulnerability exists in the AF_UNIX socket garbage collection logic in the Linux kernel. The GC algorithm determines socket liveness by comparing file reference counts against inflight file descriptor counts. MSG_PEEK on a received file descriptor bumps the file reference count without synchronizing with GC. If close() decrements a reference count while GC is evaluating unix_vertex_dead() for sockets in a strongly connected component, GC may incorrectly conclude both sockets are dead and purge a live socket's receive queue. The fix introduces seqcount_t to signal MSG_PEEK activity to GC, causing GC to defer processing of affected SCCs to subsequent runs when a race is detected. This avoids the need for locking on the MSG_PEEK fast path while preventing erroneous collection.

Defensive priority

medium

Recommended defensive actions

• Apply the relevant stable kernel patch for your version: 6.1.x, 6.6.x, 6.10.x through 6.18.x, 6.19.x, or 7.0-rc series. Patches are available via the Linux kernel stable tree.
• Upgrade to a fixed kernel version: 6.2 or later for 6.1.x branch, 6.7 or later for 6.6.x branch, 6.18.23 or later for 6.10.x-6.18.x branch, 6.19.10 or later for 6.19.x branch, or 7.0-rc8 or later for 7.0-rc series.
• If immediate patching is not feasible, monitor for kernel Oops or unexpected socket behavior in applications heavily using AF_UNIX sockets with MSG_PEEK, particularly in multi-threaded environments with frequent socket创建
• resourceLinkAnnotations
• resourceLinkAnnotations
• resourceLinkAnnotations
• resourceLinkAnnotations
• resourceLinkAnnotations

Evidence notes

The vulnerability description explicitly states this is a reintroduction of a previously-fixed issue from commit cbcf01128d0a (af_unix: fix garbage collect vs MSG_PEEK). The race condition involves unix_vertex_dead() checks, MSG_PEEK reference count bumps, and close() reference count decrements on AF_UNIX sockets in a strongly connected component. The resolution uses seqcount_t to detect MSG_PEEK races during GC and defer collection. Multiple stable kernel patches are available.

Official resources