CVE-2026-53292: Linux Kernel Phonet DoS Vulnerability

CVE-2026-53292 Overview

CVE-2026-53292 is a Linux kernel vulnerability in the Phonet protocol socket implementation. The flaw resides in pn_socket_autobind() in net/phonet/socket.c, where a BUG_ON() assertion can be triggered from a user-reachable code path. When pn_socket_bind() returns -EINVAL because sk->sk_state is not TCP_CLOSE on an unbound socket, the autobind logic incorrectly assumes the socket is already bound and asserts on a non-zero port. The assertion fires and panics the kernel. The issue was discovered by syzbot fuzzing infrastructure and is reachable through pn_socket_sendmsg() via sendto().

Critical Impact
A local unprivileged user can panic the kernel through a normal socket sendto() call, resulting in a denial of service on any system with the Phonet protocol available.

Affected Products

Linux kernel (mainline) versions containing the vulnerable pn_socket_autobind() logic in net/phonet/socket.c
Linux stable branches prior to the fix commits 5b0c911bcdbd and 6db58ee730bf
Distributions shipping kernels with the Phonet subsystem enabled (CONFIG_PHONET)

Discovery Timeline

2026-06-26 - CVE-2026-53292 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53292

Vulnerability Analysis

The Phonet subsystem implements the Nokia Phonet protocol used to communicate with cellular modems. The pn_socket_autobind() function attempts to auto-bind a socket to port 0 before a sendmsg() operation on an unbound socket. It calls pn_socket_bind() and treats an -EINVAL return as an indication that the socket was already bound, then asserts using BUG_ON(!pn_port(pn_sk(sock->sk)->sobject)) that the port is non-zero.

This assumption is incorrect. pn_socket_bind() also returns -EINVAL when sk->sk_state is not TCP_CLOSE, even if the socket has never been bound. In that scenario pn_port() remains 0, the BUG_ON() fires, and the kernel panics from a user-triggerable path. This is classified as a kernel denial-of-service defect reachable via standard socket syscalls.

Root Cause

The root cause is a conflation of two distinct error conditions behind a single -EINVAL return code. The autobind logic assumes -EINVAL uniquely means "already bound," but pn_socket_bind() also uses -EINVAL for invalid socket state. Combined with an unconditional BUG_ON() on a value controllable by userspace state, this converts a routine input error into a kernel crash.

Attack Vector

A local attacker with the ability to open a Phonet socket (AF_PHONET) can trigger the panic without privileges. The attacker creates a Phonet socket, manipulates it into a non-TCP_CLOSE state without binding, then invokes sendto(). This drives execution into pn_socket_sendmsg(), through pn_socket_autobind(), and into the failing assertion. The syzbot reproducer demonstrates this via the standard __sys_sendto path. No network access is required.

The upstream fix treats the "bind returned -EINVAL but pn_port() is still 0" case as a regular error and propagates -EINVAL to the caller rather than invoking BUG_ON(). Callers already translate non-zero returns into -ENOBUFS or -EAGAIN, so behavior changes from panic to a normal errno. See the fix in Kernel Git Commit 5b0c911 and Kernel Git Commit 6db58ee.

Detection Methods for CVE-2026-53292

Indicators of Compromise

Kernel panic messages referencing kernel BUG at net/phonet/socket.c:213
Crash traces containing pn_socket_autobind and pn_socket_sendmsg+0x240/0x250
Unexpected reboots on hosts where CONFIG_PHONET is enabled and unprivileged users can open AF_PHONET sockets

Detection Strategies

Audit loaded kernel modules for phonet.ko and check whether AF_PHONET (family 35) socket creation is reachable by unprivileged users
Monitor kernel.log, dmesg, and journalctl -k output for BUG_ON traces originating in net/phonet/socket.c
Correlate host crashes with preceding socket(AF_PHONET, ...) and sendto() syscall activity via auditd rules

Monitoring Recommendations

Enable kernel.panic_on_oops=1 in test fleets to surface latent exploitation attempts as reboot events
Forward kernel logs and crash dumps to a centralized logging platform for retention and correlation
Track syscall telemetry on Linux endpoints to identify processes creating Phonet sockets outside expected telephony workloads

How to Mitigate CVE-2026-53292

Immediate Actions Required

Apply the upstream fix commits 5b0c911bcdbd982f7748d11c0b39ec5808eae2de and 6db58ee730bf434d1afca91b91826e26688856ed from the Linux stable tree
Rebuild and deploy patched kernels across affected Linux hosts, prioritizing multi-tenant systems where local users are untrusted
If patching is not immediately possible, disable the Phonet module and blacklist it from being auto-loaded

Patch Information

The fix removes the BUG_ON() and returns -EINVAL to the caller when pn_socket_bind() fails without the socket having been bound. Patches are available in the Linux stable tree via Kernel Git Commit 5b0c911 and Kernel Git Commit 6db58ee. Distribution vendors will backport these commits into their supported kernel branches.

Workarounds

Unload the Phonet module with rmmod phonet on systems that do not require Nokia cellular modem communication
Prevent module auto-load by adding install phonet /bin/true to /etc/modprobe.d/blacklist-phonet.conf
Restrict socket family access using seccomp profiles or SELinux policies that deny AF_PHONET socket creation to non-telephony workloads

bash

# Configuration example: blacklist the Phonet module
echo "install phonet /bin/true" | sudo tee /etc/modprobe.d/blacklist-phonet.conf
sudo rmmod phonet 2>/dev/null || true
lsmod | grep phonet