PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45887 Linux CVE debrief

A memory leak vulnerability exists in the Linux kernel's AF_UNIX socket implementation. Specifically, in the `unix_stream_connect()` function, when `prepare_peercred()` fails, the newly created socket (`newsk`) is not properly released via `unix_release_sock()`, resulting in a memory leak. The fix reorders operations to call `prepare_peercred()` before `unix_create1()`, ensuring that credential preparation failures occur before socket allocation, thus preventing the leak.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Linux system administrators, kernel maintainers, and security teams responsible for kernel patch management and memory-constrained environments

Technical summary

The vulnerability is a memory leak in the Linux kernel's AF_UNIX socket subsystem. In `unix_stream_connect()`, if `prepare_peercred()` fails after `unix_create1()` has allocated a new socket (`newsk`), the error handling path does not call `unix_release_sock()` to free the allocated socket structure. The resolution moves `prepare_peercred()` to execute before `unix_create1()`, ensuring that credential-related failures occur prior to socket allocation and eliminating the leak condition.

Defensive priority

medium

Recommended defensive actions

  • Review Linux kernel versions in use and apply stable kernel updates containing the referenced commits
  • Monitor vendor security advisories for distribution-specific kernel packages
  • Assess systems utilizing AF_UNIX stream sockets for potential memory pressure impacts
  • Verify kernel update deployment through standard patch management workflows

Evidence notes

The vulnerability description and resolution are sourced from the official CVE record published 2026-05-27. The fix involves reordering function calls in `unix_stream_connect()` to prevent memory leak on `prepare_peercred()` failure. Three kernel.org stable tree commits are referenced as source material.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45887 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45887

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45887 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45887

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/365996a2b14d07caa9e33d367b67ea26c09d89b4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6884028cd7f275f8bcb854a347265cb1fb0e4bea

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a5d95d7caba0160fb7b2b8d2bd96d5a1be861d9f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.