HarborGuard / CVE
Back to search
HIGHCVE-2026-31673Published Modified CNA Linux

CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock

In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock. This keeps the VFS data stable while the reply is being built.

Metrics

CVSS v3.1
7.8
Severity
HIGH
Fixed in
0
Affected Products
2

Fix available

00c739f3785f84af695952c2bac8be2f45082c9b839897df386376912d561d4946499379effa1e7ef6.6.1366.12.836.18.246.19.147.0900a4e0910e98b8caef117d5df00471fa438dcf9b9232421a77a649c9376c99fdfc8cb7f79cad34cbdf206e740bf2919d818f132c8c9cc7ed91d11c0
Affected packages
  • Linux / Linux
    < b9232421a77a649c9376c99fdfc8cb7f79cad34c (from 5f7b0569460b7d8d01ca776430a00505a68b7584) · < 0c739f3785f84af695952c2bac8be2f45082c9b8 (from 5f7b0569460b7d8d01ca776430a00505a68b7584) · < 900a4e0910e98b8caef117d5df00471fa438dcf9 (from 5f7b0569460b7d8d01ca776430a00505a68b7584) · < bdf206e740bf2919d818f132c8c9cc7ed91d11c0 (from 5f7b0569460b7d8d01ca776430a00505a68b7584) · < 39897df386376912d561d4946499379effa1e7ef (from 5f7b0569460b7d8d01ca776430a00505a68b7584)
  • Linux / Linux
    3.3
    Fixed in 0, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References