CVE-2026-53034: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53034 Overview

CVE-2026-53034 is a NULL pointer dereference vulnerability in the Linux kernel's BPF sockmap subsystem affecting AF_UNIX stream sockets. The flaw exists in unix_stream_bpf_update_proto() where a race condition between unix_stream_connect() and sockmap updates allows the kernel to operate on a socket whose peer has not yet been assigned. The kernel sets sk_state to TCP_ESTABLISHED before assigning unix_peer(sk) = newsk, creating a window where sock_map_sk_state_allowed() returns true for an incompletely initialized socket. A concurrent bpf(BPF_MAP_UPDATE_ELEM) call dereferences the NULL peer pointer, triggering a kernel crash.

Critical Impact
Local unprivileged or BPF-capable processes can trigger a kernel NULL pointer dereference in unix_stream_bpf_update_proto+0xa0/0x1b0, causing denial of service through a kernel panic.

Affected Products

Linux kernel versions containing BPF sockmap support for AF_UNIX stream sockets
Distributions shipping affected upstream kernel commits prior to the fix
Stable kernel branches referenced in the kernel.org commit series

Discovery Timeline

2026-06-24 - CVE-2026-53034 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53034

Vulnerability Analysis

The vulnerability is a race condition resulting in a NULL pointer dereference [CWE-476] within the BPF sockmap update path for AF_UNIX stream sockets. The defect lives at the intersection of two subsystems: the AF_UNIX connection logic in unix_stream_connect() and the sockmap proto update logic in unix_stream_bpf_update_proto().

The sock_map_sk_state_allowed() helper uses sk->sk_state == TCP_ESTABLISHED as a proxy for a fully initialized socket. However, unix_stream_connect() sets sk_state to TCP_ESTABLISHED via WRITE_ONCE() before assigning the peer with unix_peer(sk) = newsk. This ordering leaves a small window where a concurrent CPU executing sock_map_update_elem_sys() observes the established state and proceeds to read unix_peer(sk), which still returns NULL.

The resulting call chain crashes at unix_stream_bpf_update_proto+0xa0/0x1b0, reached through sock_map_link → sock_map_update_common → sock_map_update_elem_sys → __sys_bpf.

Root Cause

The root cause is ordering between sk_state publication and peer assignment in unix_stream_connect(). Earlier fixes considered reordering the writes or adding unix_state_lock() to the sockmap path, but both were rejected. Reordering required an additional memory barrier on a hot path. Acquiring unix_state_lock() from sockmap would deadlock against TC BPF programs of type BPF_PROG_TYPE_SCHED_CLS and BPF_PROG_TYPE_SCHED_ACT running in softirq context. The accepted fix introduces a NULL check for unix_peer(sk) inside unix_stream_bpf_update_proto().

Attack Vector

A local attacker with the ability to issue bpf() syscalls and trigger AF_UNIX stream connections can race the two operations to reach the NULL dereference. The attacker repeatedly calls connect() on an AF_UNIX stream socket while a second thread issues BPF_MAP_UPDATE_ELEM against a sockmap containing that socket. BPF program contexts permitted to update sockmaps, including BPF_PROG_TYPE_SOCK_OPS and BPF_PROG_TYPE_SCHED_CLS, can reach the same path. The crash signature is kernel NULL pointer dereference, address: 0000000000000080 at unix_stream_bpf_update_proto+0xa0/0x1b0.

The vulnerability mechanism is described in the upstream kernel commit messages. See the Linux Kernel Commit Update for the full technical analysis.

Detection Methods for CVE-2026-53034

Indicators of Compromise

Kernel oops or panic entries in dmesg referencing unix_stream_bpf_update_proto in the faulting RIP
Crash addresses near 0x80 offset indicating dereference of a NULL unix_peer structure
Call traces including sock_map_link, sock_map_update_common, and sock_map_update_elem_sys
Unexpected node reboots on hosts running workloads that combine sockmap and AF_UNIX traffic

Detection Strategies

Monitor kernel ring buffer logs for BUG: kernel NULL pointer dereference events correlated with BPF syscall activity
Audit bpf() syscall usage via auditd rules targeting BPF_MAP_UPDATE_ELEM against BPF_MAP_TYPE_SOCKMAP and BPF_MAP_TYPE_SOCKHASH
Inventory running kernels against the fixed commit hashes published on kernel.org

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized logging platform for crash signature analysis
Track which workloads load BPF programs of type SCHED_CLS, SCHED_ACT, or SOCK_OPS that interact with AF_UNIX sockets
Alert on repeated kernel crashes on the same host, which may indicate exploitation attempts rather than incidental races

How to Mitigate CVE-2026-53034

Immediate Actions Required

Identify Linux hosts running kernel versions that include BPF sockmap support for AF_UNIX without the NULL check patch
Apply distribution kernel updates that incorporate the upstream fix adding the unix_peer(sk) NULL check in unix_stream_bpf_update_proto()
Restrict CAP_BPF and CAP_NET_ADMIN capabilities to trusted workloads only
Where patching is delayed, disable workloads that combine sockmap updates with AF_UNIX stream sockets

Patch Information

The fix is committed to the upstream Linux kernel and backported to stable branches. Refer to the kernel.org commits: 041eb6348d73, 37bfcd164161, 4913c94a3adc, 75b7d3b3f8bd, a94d3dd78ee8, and dca38b7734d2. Consume the patched kernel through your distribution vendor's security channel.

Workarounds

Remove CAP_BPF from non-essential users and containers to block local attempts to call BPF_MAP_UPDATE_ELEM on sockmaps
Use seccomp profiles to deny the bpf() syscall for workloads that do not require it
Avoid attaching AF_UNIX stream sockets to BPF_MAP_TYPE_SOCKMAP or BPF_MAP_TYPE_SOCKHASH until the patched kernel is deployed

bash

# Verify the running kernel and check for the fix
uname -r
# Confirm whether the kernel package includes the sockmap af_unix fix
rpm -q --changelog kernel | grep -i 'sockmap.*af_unix' || \
  dpkg -s linux-image-$(uname -r) | grep -i version

# Restrict bpf() syscall via seccomp for untrusted services (systemd unit example)
# Add to the [Service] section:
#   SystemCallFilter=~@bpf
#   CapabilityBoundingSet=~CAP_BPF CAP_SYS_ADMIN