Look up another CVE · open CVE-2026-53361 in the interactive tracker
CVE-2026-53361
af_unix: Set gc_in_progress to true in unix_gc().
Published 2026-07-04 (4 months ago) by the Linux kernel CNA. Subsystem net/unix. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-53361 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6381-1 · 2026-07-05 · text | 6.12.95-1 | Update the kernel and reboot. DSA-6381-1 shipped the fix on 2026-07-05, in 6.12.95-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.3-1 | Update the kernel and reboot. Fixed in 7.1.3-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/unix/garbage.c
- What this is
- NETWORKING [UNIX SOCKETS]MAINTAINERS section matched on net/unix/ · Maintained
Check it on the machine
grep -w CONFIG_UNIX /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_UNIX
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-04 (4 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.23%, higher than 13.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/unix
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.1.141 | 6.1.183 | 20aa894d475b |
| 6.6.93 | 6.6.144 | 82c17e13d404 |
| 6.9 | 6.12.95 | 591f1ac21742 |
| 6.9 | 6.18.38 | 0cfa78c05066 |
| 6.9 | 7.1 | d82ba05263c6 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6381-1 | 2026-07-05 | trixie 6.12.95-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable AF_UNIX garbage-collection path is reached through local socket syscalls such as socketpair(), sendmsg() with SCM_RIGHTS, recvmsg(MSG_PEEK), and close(). It is not reachable directly from network packets.
- AC:LAttack complexity, low
- Although this is a race, the attacker can control the relevant operations by creating AF_UNIX FD cycles, issuing concurrent GC-triggering sends, peeking, and closing sockets. No victim timing or external condition is required beyond scheduler interleaving.
- PR:LPrivileges required, low
- The path is available to an unprivileged local user through ordinary AF_UNIX sockets and SCM_RIGHTS; there is no capability check for socket creation, FD passing, or MSG_PEEK. It still requires local code execution, so privileges are Low rather than None.
- UI:NUser interaction, none
- No victim interaction is required once the local attacker can run code. The attacker can create the sockets, pass FDs, trigger GC, and race MSG_PEEK independently.
- S:UScope, unchanged
- The impact remains within the kernel/local IPC security authority. This is not a VM escape, IOMMU bypass, or other cross-scope boundary violation.
- C:NConfidentiality impact, none
- The bug causes stale GC liveness decisions and purging of live AF_UNIX receive queues, but I did not find a new arbitrary read or unintended disclosure primitive. MSG_PEEK-visible descriptors are already exposed to the receiving endpoint by design.
- I:HIntegrity impact, high
- The race can make GC incorrectly collect a live AF_UNIX SCC and purge live receive queues, dropping queued data and SCM_RIGHTS file descriptors. That is unauthorized corruption/destruction of kernel-maintained IPC state, so integrity impact is High.
- A:HAvailability impact, high
- The attacker can repeatedly cause live AF_UNIX sockets to lose queued messages and passed FDs, breaking IPC semantics and potentially denying service to affected local components. Under the required higher-severity rule, this supports High availability impact.