CVE-2026-53033: Linux Kernel Race Condition Vulnerability

CVE-2026-53033 Overview

CVE-2026-53033 is a use-after-free vulnerability in the Linux kernel's BPF sockmap implementation. The flaw exists in unix_stream_bpf_update_proto() when a BPF iterator program updates a sockmap concurrently with a socket close operation. A race condition between TCP_ESTABLISHED and TCP_CLOSE state transitions allows the peer pointer to become stale, leading to a use-after-free on the peer socket. The issue was detected by Kernel Address Sanitizer (KASAN) during execution of the test_progs selftest. The fix takes the appropriate state lock when iterating over af_unix sockets, ensuring the iterator program receives a consistent and stable socket reference.

Critical Impact
A local attacker with the ability to run BPF iterator programs can trigger a use-after-free in kernel memory, potentially leading to kernel memory corruption or privilege escalation.

Affected Products

Linux kernel (mainline) with BPF sockmap and af_unix iterator support
Stable kernel branches receiving backported commits referenced in the kernel.org advisories
Distributions shipping affected kernels until patches are merged

Discovery Timeline

2026-06-24 - CVE-2026-53033 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53033

Vulnerability Analysis

The vulnerability is a race condition leading to a use-after-free in the BPF sockmap subsystem. When a BPF iterator program calls sock_map_update_elem() against a unix_stream socket, the kernel invokes unix_stream_bpf_update_proto() to install the BPF protocol operations. This function reads the peer socket pointer through unix_peer(sk), performs a NULL check, and then calls sock_hold() to take a reference. Without holding the state lock, a concurrent unix_release_sock() on another CPU can NULL out unix_peer(sk) and drop the final reference via sock_put(skpair). The original CPU then calls sock_hold() on freed memory.

The KASAN report confirms the unsafe write of 4 bytes to a freed slab object. The freeing path runs through __sk_destruct() after unix_release_sock(), while the allocating path originates from unix_create1() during unix_stream_connect().

Root Cause

The root cause is missing synchronization between the BPF iterator update path and the socket release path. The unix_peer(sk) accessor is read without holding unix_state_lock(sk), creating a time-of-check to time-of-use window. During the TCP_ESTABLISHED to TCP_CLOSE state transition, the peer pointer is cleared and its reference dropped, but the iterator continues to operate on the stale pointer.

Attack Vector

Exploitation requires local access and the ability to load and run BPF programs, typically granted to processes with CAP_BPF or CAP_SYS_ADMIN. An attacker schedules a BPF iterator program that updates a sockmap entry for a unix_stream socket while another thread closes the peer connection. Winning the race produces a write to freed slab memory, which can be leveraged for kernel memory corruption.

No verified public proof-of-concept exploitation code is available beyond the reproducer embedded in the kernel selftest test_progs. The vulnerability mechanism is described in the upstream commit messages referenced under technical references.

Detection Methods for CVE-2026-53033

Indicators of Compromise

KASAN reports in dmesg containing slab-use-after-free in unix_stream_bpf_update_proto
Kernel oops or panic traces referencing sock_map_update_common and bpf_iter_unix_seq_show
Unexpected segmentation faults or memory corruption in processes loading BPF iterator programs targeting unix sockets

Detection Strategies

Audit kernel versions against the fixed commits listed at kernel.org commit 1a59cc6b and the additional stable backports referenced in the advisory.
Monitor for unprivileged or unexpected BPF program loads using bpf() syscall auditing with auditd rules targeting BPF_PROG_LOAD and BPF_MAP_UPDATE_ELEM.
Enable KASAN on test and staging kernels to surface use-after-free conditions before production deployment.

Monitoring Recommendations

Collect and centralize kernel ring buffer logs and forward KASAN, oops, and BUG messages to a SIEM for correlation.
Track processes invoking bpf() syscalls with sockmap operations on AF_UNIX sockets, particularly from non-root contexts holding CAP_BPF.
Alert on unexpected loads of BPF iterator programs that traverse unix socket tables in production environments.

How to Mitigate CVE-2026-53033

Immediate Actions Required

Apply the upstream kernel patch that takes unix_state_lock(sk) around the peer pointer access in unix_stream_bpf_update_proto().
Restrict the CAP_BPF and CAP_SYS_ADMIN capabilities to trusted system components and remove them from unprivileged workloads.
Set kernel.unprivileged_bpf_disabled=1 to prevent unprivileged users from loading BPF programs on systems where this is feasible.

Patch Information

The fix is delivered through the upstream Linux kernel commits referenced in the kernel.org advisories. See Kernel Git Commit 1, Commit 2, Commit 3, Commit 4, Commit 5, and Commit 6. Distribution vendors will incorporate these commits into stable kernel releases.

Workarounds

Disable unprivileged BPF program loading by setting the sysctl kernel.unprivileged_bpf_disabled=1 until the patched kernel can be deployed.
Limit CAP_BPF to a minimal set of administrative service accounts and audit existing grants.
Avoid running untrusted BPF iterator programs that target AF_UNIX sockmaps on unpatched kernels.

bash

# Configuration example
# Disable unprivileged BPF program loading
sysctl -w kernel.unprivileged_bpf_disabled=1
echo 'kernel.unprivileged_bpf_disabled=1' >> /etc/sysctl.d/90-bpf-hardening.conf

# Verify the current kernel version against patched stable releases
uname -r