CVE-2026-53005: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53005 Overview

CVE-2026-53005 is a use-after-free vulnerability in the Linux kernel's af_unix subsystem. The flaw resides in the interaction between SOCKMAP and the AF_UNIX garbage collector (GC). SOCKMAP can hide inflight file descriptors from the AF_UNIX GC, causing leaked inflight sockets and breaking the Tarjan-based GC's assumption that unix_edge.successor is always alive. When a socket in SOCKMAP receives an skb with an inflight fd, sk_psock_verdict_data_ready() enqueues the skb to psock->ingress_skb, where neither the old nor new GC can inspect it.

Critical Impact
Local attackers can trigger a kernel use-after-free in unix_del_edges(), leading to memory corruption, potential privilege escalation, and incorrect file descriptor accounting in unix_show_fdinfo().

Affected Products

Linux kernel versions containing SOCKMAP and AF_UNIX integration prior to the fix commits
Distributions shipping vulnerable mainline and stable kernels
Systems with eBPF SOCKMAP functionality enabled

Discovery Timeline

2026-06-24 - CVE-2026-53005 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53005

Vulnerability Analysis

The vulnerability stems from SOCKMAP redirect logic bypassing the AF_UNIX garbage collector's visibility into inflight file descriptors. When a Unix domain socket is added to a SOCKMAP, incoming skb buffers carrying SCM rights (file descriptors) are redirected via sk_psock_verdict_data_ready() into the psock ingress queue. The AF_UNIX GC, which tracks inflight sockets to detect reference cycles, cannot inspect this queue. Inflight sockets become hidden from cycle detection while remaining linked to the global inflight list, escaping detection by kmemleak.

Root Cause

The Tarjan-based AF_UNIX GC assumes unix_edge.successor remains alive throughout traversal. SOCKMAP redirection violates this invariant by relocating skbs (and their attached fds) to a queue outside the GC's visibility. When sk_psock_backlog later processes the queued skb through unix_destruct_scm() and unix_destroy_fpl(), the call to unix_del_edges() dereferences a freed socket structure. Additionally, SOCKMAP fails to invoke scm_stat_del(), corrupting the file descriptor accounting reported by unix_show_fdinfo().

Attack Vector

A local unprivileged process can construct the unsafe state by creating a socketpair, sending file descriptors via SCM_RIGHTS, then redirecting traffic through a SOCKMAP. Triggering the GC after socket destruction produces the KASAN-detected slab-use-after-free in unix_del_edges() (net/unix/garbage.c:118). The fix drops all SCM attributes before passing an skb to the SOCKMAP layer, since sk_msg_recvmsg() does not support SCM attributes regardless. Refer to the kernel commit b34a1d83c74a for the patch details.

Detection Methods for CVE-2026-53005

Indicators of Compromise

KASAN reports containing slab-use-after-free in unix_del_edges in kernel logs
Crashes within sk_psock_backlog workqueue execution paths
Inconsistent file descriptor counts reported by /proc/<pid>/fdinfo/ for Unix domain sockets
Unexplained kernel panics on hosts using eBPF SOCKMAP programs

Detection Strategies

Monitor dmesg and kernel ring buffer output for KASAN or general protection fault traces referencing unix_del_edges, unix_destroy_fpl, or unix_destruct_scm
Audit running eBPF programs using bpftool prog list to identify SOCKMAP usage on Unix domain sockets
Track installed kernel versions across the fleet against patched stable releases

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on use-after-free signatures
Baseline expected SOCKMAP usage and flag unauthorized BPF map creation events
Audit setsockopt and bpf() syscall activity from unprivileged processes

How to Mitigate CVE-2026-53005

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and reboot affected systems
Inventory all hosts running kernels with SOCKMAP support enabled and prioritize patching multi-tenant or container hosts
Restrict the bpf() syscall to privileged users by setting kernel.unprivileged_bpf_disabled=1

Patch Information

The fix drops all SCM attributes before passing an skb to the SOCKMAP layer. The relevant stable kernel commits are 965dc93481d1 and b34a1d83c74a. Update to a kernel build that includes these commits.

Workarounds

Disable unprivileged BPF via the sysctl kernel.unprivileged_bpf_disabled=1 to limit attack surface
Avoid attaching Unix domain sockets that exchange SCM_RIGHTS to SOCKMAP programs until kernels are patched
Apply seccomp policies restricting bpf() and socketpair() for untrusted workloads

bash

# Disable unprivileged BPF system-wide
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-bpf-hardening.conf
sudo sysctl --system

# Verify kernel version contains the fix
uname -r