CVE-2026-80521
Received Received - Intake

Use-After-Free in Linux Kernel Unix Domain Sockets

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80521
EUVD
EUVD-2026-66587

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a race condition in the AF_UNIX socket subsystem can lead to improper garbage collection of socket connections. The issue occurs when two socket connection groups (SCCs) are created and operations are performed concurrently. A partially freed SCC may remain in memory due to a timing window where a socket buffer (skb) is not properly queued before garbage collection runs.

Detection Guidance

This vulnerability is specific to the Linux kernel's AF_UNIX implementation and may not have direct network detection methods. Monitor kernel logs for crashes or unusual behavior in socket operations. Check for kernel oops messages or warnings related to unix_del_edge() or SCC handling.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service by triggering memory leaks or system instability. It may lead to resource exhaustion as dead socket connections are not properly cleaned up, potentially causing system slowdowns or crashes.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate patching is not possible, avoid concurrent send() and close() operations on AF_UNIX sockets to reduce exposure. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80521. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart