CVE-2026-45887: Linux Kernel Memory Leak Vulnerability

CVE-2026-45887 Overview

CVE-2026-45887 is a memory leak vulnerability in the Linux kernel's af_unix subsystem. The flaw resides in the unix_stream_connect() function, which handles connection establishment for UNIX domain stream sockets. When prepare_peercred() fails during connection setup, the kernel does not invoke unix_release_sock() on the newly allocated socket (newsk), causing the associated memory to leak. Repeated failures can progressively exhaust kernel memory on affected systems. Upstream maintainers resolved the issue by reordering the call sequence so prepare_peercred() executes before unix_create1(), ensuring no socket allocation precedes a failure path that lacks cleanup.

Critical Impact
Repeated prepare_peercred() failures during UNIX domain socket connection attempts leak kernel memory, potentially leading to resource exhaustion on long-running Linux systems.

Affected Products

Linux kernel versions containing the af_unixunix_stream_connect() code path prior to the referenced upstream fixes
Stable kernel branches receiving backports via commits 365996a, 6884028, and a5d95d7
Distributions shipping vulnerable kernels until backports are integrated

Discovery Timeline

2026-05-27 - CVE-2026-45887 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45887

Vulnerability Analysis

The vulnerability is a kernel memory leak in the UNIX domain socket implementation (net/unix/af_unix.c). During unix_stream_connect(), the kernel allocates a new socket structure (newsk) via unix_create1() before calling prepare_peercred() to attach peer credential information. If prepare_peercred() fails — for example, under memory pressure or credential allocation errors — the function returns without releasing newsk. Because unix_release_sock() is the proper teardown routine for fully initialized UNIX sockets, skipping it leaves the allocated socket and its associated resources orphaned in kernel memory.

The leak is triggered along a recoverable error path rather than a crash path, so the system continues operating while silently losing memory. Each failed connection attempt that exercises this path compounds the leak. Workloads that aggressively open UNIX domain stream sockets — common in container runtimes, init systems, and IPC-heavy services — amplify the impact.

Root Cause

The root cause is an ordering defect in resource acquisition and cleanup within unix_stream_connect(). The fix relocates prepare_peercred() ahead of unix_create1() so that credential preparation, which can fail, runs before any socket allocation occurs. With this ordering, a failure no longer leaves an allocated newsk requiring release. This is a classic resource lifecycle bug categorized as a memory leak [CWE-401].

Attack Vector

A local unprivileged process can repeatedly invoke connect() against UNIX domain stream sockets under conditions that induce prepare_peercred() failure. Sustained triggering progressively consumes non-reclaimable kernel memory, contributing to denial-of-service conditions on shared hosts and multi-tenant Linux systems. No remote attack vector exists, and the issue does not provide code execution or privilege escalation primitives. The vulnerability description does not include verified proof-of-concept code, so a prose description of the fix and call ordering — available in the referenced upstream commits — is the authoritative technical reference.

Detection Methods for CVE-2026-45887

Indicators of Compromise

Gradual unaccounted growth in kernel Slab or SUnreclaim memory in /proc/meminfo on hosts running vulnerable kernels
Elevated allocation counts for UNIX socket slab caches (e.g., UNIX, sock_inode_cache) visible via slabtop or /proc/slabinfo
Userspace processes generating high volumes of failed connect() calls to UNIX domain sockets

Detection Strategies

Compare running kernel version and patch level against the upstream fix commits 365996a2b14d, 6884028cd7f2, and a5d95d7caba0
Monitor long-running hosts for unbounded kernel memory growth that does not correlate with workload changes
Audit eBPF or perf traces of unix_stream_connect return paths to identify error-path executions in production

Monitoring Recommendations

Establish baselines for kernel slab consumption and alert on sustained deviations
Track connect() syscall error rates per process to flag abusive or buggy callers
Collect kernel version inventory across the fleet to identify hosts still exposed to the unpatched code path

How to Mitigate CVE-2026-45887

Immediate Actions Required

Inventory Linux hosts and identify kernels predating the fix commits referenced in the upstream advisory
Schedule kernel updates to a release that includes the backport of commit a5d95d7caba0160fb7b2b8d2bd96d5a1be861d9f or its stable equivalents
Reboot affected systems after patching to load the corrected kernel image

Patch Information

The fix moves prepare_peercred() before unix_create1() in unix_stream_connect(). Apply the upstream patches available at Kernel Git Commit 365996a, Kernel Git Commit 6884028, and Kernel Git Commit a5d95d7. Distribution-provided kernel updates incorporating these commits are the recommended remediation path.

Workarounds

No supported workaround replaces patching; the defect is in kernel code paths exercised by standard socket APIs
Restrict untrusted local workloads from generating high volumes of failing UNIX socket connect() calls using cgroup resource limits
Apply per-process memory and syscall rate limits where feasible to reduce leak amplification until the kernel is updated

bash

# Verify running kernel version and check for the fix
uname -r

# Inspect UNIX socket slab usage on a suspect host
grep -E 'UNIX|sock_inode_cache' /proc/slabinfo

# Apply distribution kernel updates (Debian/Ubuntu example)
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r)
sudo reboot