CVE-2026-80521 Overview
CVE-2026-80521 is a race condition in the Linux kernel's af_unix subsystem affecting garbage collection of Unix domain sockets with SCM_RIGHTS file descriptor passing. The flaw exists in the strongly connected component (SCC) tracking logic used by the Unix socket garbage collector. A local attacker can trigger the race by concurrently sending file descriptors between sockets and closing them, causing the garbage collector to iterate over a freed scc_entry during a subsequent run. The kernel maintainers resolved the issue by unlinking scc_entry before freeing the vertex in unix_del_edge().
Critical Impact
Local attackers with the ability to create Unix domain sockets can trigger a use-after-free in kernel memory, potentially enabling privilege escalation or denial of service.
Affected Products
- Linux kernel (mainline) — net/unix/garbage.c
- Distributions shipping affected stable branches prior to backport of commit 594d905195024b228c962627ae5ae7c17bd582a4
- Any Linux system permitting Unix domain socket creation and SCM_RIGHTS passing between unprivileged processes
Discovery Timeline
- Vulnerability reported by Kyle Zeng
- 2026-08-26 - CVE-2026-80521 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80521
Vulnerability Analysis
The defect lives in the Unix socket garbage collector, which uses Tarjan's algorithm to detect strongly connected components of sockets referencing each other via in-flight file descriptors. When sendmsg() transfers a socket file descriptor through SCM_RIGHTS, unix_add_edges() registers a new edge in the SCC graph before skb_queue_tail() enqueues the actual skb carrying the reference.
A narrow window exists between edge publication and skb queuing. If both endpoint sockets are closed and garbage collection runs during this window, the collector marks the pair as dead but cannot reclaim the socket still referenced by the not-yet-queued skb. The stale vertex remains linked into another live SCC's scc_entry list. A subsequent garbage collection pass invokes unix_walk_scc_fast(), which traverses the freed vertex through scc_entry, triggering a use-after-free.
Root Cause
The root cause is a race condition [CWE-362] combined with incomplete cleanup in unix_del_edge(). The function frees a vertex without first unlinking its scc_entry from any adjacent SCC's linked list. Because the vertex remains reachable through neighboring components, later graph walks dereference freed memory.
Attack Vector
Exploitation requires local access and the ability to create Unix domain sockets. An attacker constructs two SCCs by exchanging socket file descriptors, then concurrently issues a self-referential sendmsg() and closes both peer sockets. Repeated attempts widen the race window and increase the probability of triggering garbage collection at the vulnerable moment. Successful exploitation yields kernel memory corruption suitable for privilege escalation or kernel panic.
No public exploitation code or proof-of-concept is currently referenced in the advisory data. Refer to the Linux Kernel Commit Changes and Linux Kernel Patch Proposal for the authoritative diff.
Detection Methods for CVE-2026-80521
Indicators of Compromise
- Kernel oops or panic referencing unix_walk_scc_fast, unix_del_edge, or scc_entry in the stack trace
- KASAN use-after-free reports in the net/unix/garbage.c code path on kernels with sanitizers enabled
- Unexplained system crashes on hosts running untrusted local workloads that use SCM_RIGHTS
Detection Strategies
- Monitor dmesg and journal logs for kernel warnings, BUG reports, or slab corruption originating in the Unix socket garbage collector
- Audit installed kernel package versions against distribution advisories referencing the af_unix SCC fix
- Instrument eBPF probes on unix_add_edges and unix_del_edge to observe abnormal edge churn from a single process
Monitoring Recommendations
- Track process creation of sockets with SOCK_STREAM/SOCK_DGRAM AF_UNIX combined with high sendmsg rates carrying SCM_RIGHTS ancillary data
- Alert on repeated kernel warnings from the same host, which may indicate exploitation attempts hitting the race window
- Correlate local user activity with kernel stability events using centralized log aggregation
How to Mitigate CVE-2026-80521
Immediate Actions Required
- Apply the upstream kernel patch that unlinks scc_entry inside unix_del_edge() before freeing the vertex
- Update to distribution kernels that incorporate commits 594d905195024b228c962627ae5ae7c17bd582a4 and e3702470ced94fad74d71e2232f022d2eb752a6d
- Reboot affected hosts after patching to load the fixed kernel image
Patch Information
The fix is available in the mainline kernel via the referenced stable-tree commits. See the Linux Kernel Patch Proposal and Linux Kernel Commit Changes for the authoritative changes. Distribution maintainers are backporting the fix to supported stable branches.
Workarounds
- Restrict unprivileged user access on multi-tenant systems until patched kernels are deployed
- Apply seccomp or Landlock policies that block untrusted processes from passing file descriptors via SCM_RIGHTS where feasible
- Deploy kernel live-patching where supported by the distribution to close the window without immediate reboots
# Verify running kernel version and check for the fix
uname -r
# Example: check package changelog for the af_unix SCC entry fix
rpm -q --changelog kernel | grep -i "af_unix.*scc_entry" | head
# On Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -i "af_unix.*scc"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
