CVE-2026-52928: Linux Kernel AF_UNIX SIOCATMARK Vulnerability

CVE-2026-52928 Overview

CVE-2026-52928 is a Linux kernel vulnerability in the af_unix subsystem. The SIOCATMARK ioctl reports whether the receive queue is at the urgent mark for MSG_OOB data. In AF_UNIX, MSG_OOB is only supported for SOCK_STREAM sockets. However, SOCK_DGRAM and SOCK_SEQPACKET sockets did not reject SIOCATMARK, creating an inconsistency with their sendmsg() and recvmsg() behavior. The fix returns -EOPNOTSUPP for non-stream sockets before checking the receive queue. The issue affects the Linux kernel and was resolved through upstream commits.

Critical Impact
Inconsistent handling of the SIOCATMARK ioctl on non-stream AF_UNIX sockets could allow userspace applications to query state on socket types where MSG_OOB is not supported, leading to incorrect kernel behavior.

Affected Products

Linux kernel (upstream)
Linux distributions shipping affected stable kernel branches
Systems using AF_UNIXSOCK_DGRAM or SOCK_SEQPACKET sockets

Discovery Timeline

2026-06-24 - CVE-2026-52928 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52928

Vulnerability Analysis

The vulnerability resides in the af_unix socket implementation of the Linux kernel. The SIOCATMARK ioctl reports whether the receive queue is at the urgent mark, a concept tied to out-of-band (MSG_OOB) data handling. In the AF_UNIX address family, only SOCK_STREAM sockets support MSG_OOB.

Despite this, SOCK_DGRAM and SOCK_SEQPACKET sockets accepted SIOCATMARK requests and proceeded to inspect the receive queue. This created an inconsistency: sendmsg() and recvmsg() already reject MSG_OOB on these socket types, yet the ioctl path did not.

The upstream fix modifies the ioctl handler to return -EOPNOTSUPP for non-stream sockets before any receive queue inspection occurs. This enforces consistent semantics across the socket APIs and avoids returning misleading state to userspace.

Root Cause

The root cause is missing socket-type validation in the SIOCATMARK code path. The handler did not verify that the socket was SOCK_STREAM before performing checks that are meaningful only for stream sockets supporting urgent data.

Attack Vector

The issue is reachable from any local process that can open an AF_UNIXSOCK_DGRAM or SOCK_SEQPACKET socket and issue the SIOCATMARK ioctl. The vulnerability is local in nature and represents an API consistency defect rather than a memory corruption primitive. No remote attack vector exists. See the upstream commits for technical details: Kernel Git Commit 3147ddf, Kernel Git Commit 645b1ed, Kernel Git Commit c34c414, and Kernel Git Commit d119775.

Detection Methods for CVE-2026-52928

Indicators of Compromise

No public indicators of compromise are associated with CVE-2026-52928 at this time.
The defect is an API consistency issue without observable exploitation artifacts.

Detection Strategies

Inventory running kernel versions across Linux fleets and compare against patched stable branches referenced in the upstream commits.
Audit local applications that invoke ioctl(fd, SIOCATMARK, ...) on AF_UNIX sockets to identify code paths relying on the previous behavior.
Track kernel package versions via configuration management to confirm patched builds are deployed.

Monitoring Recommendations

Monitor kernel update channels for the affected distributions and validate that stable kernel updates incorporating the upstream commits are applied.
Log and review unexpected EOPNOTSUPP returns from SIOCATMARK calls in application telemetry after patching.

How to Mitigate CVE-2026-52928

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that includes the af_unixSIOCATMARK fix.
Rebuild and redeploy any custom kernels using the upstream commits referenced in the NVD entry.
Validate that applications using AF_UNIXSOCK_DGRAM or SOCK_SEQPACKET sockets handle EOPNOTSUPP returns from SIOCATMARK correctly.

Patch Information

The fix is available in upstream stable Linux kernel commits: 3147ddf5a41c, 645b1ed3259a, c34c41446acf, and d119775f2bad. Consult your distribution's security advisories for the corresponding package versions.

Workarounds

No supported workaround exists outside of applying the upstream patch.
Where patching is delayed, audit application code to avoid issuing SIOCATMARK on non-stream AF_UNIX sockets.

bash

# Configuration example
# Verify the running kernel version and update via the distribution package manager
uname -r
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f1-2)
# Or for RPM-based systems
sudo dnf update kernel