Skip to main content

Linux Kernel CVE-2026-31673

| EUVDEUVD-2026-25640 HIGH
2026-04-25 Linux
Information Disclosure Linux
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.3 MEDIUM

Local sock_diag access gives PR:L/AV:L; the release race makes it timing-dependent (AC:H); reading freed VFS memory leaks data (C:H) and can crash (A:H) with no realistic integrity impact (I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:17 vuln.today
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
EUVD ID Assigned
Apr 25, 2026 - 09:00 euvd
EUVD-2026-25640
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock.

This keeps the VFS data stable while the reply is being built.

AnalysisAI

Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).

Technical ContextAI

The flaw lives in the AF_UNIX (Unix domain socket) diagnostics path exposed through the sock_diag netlink interface (UNIX_DIAG). When a userspace tool such as 'ss' requests VFS metadata (UDIAG_SHOW_VFS / UNIX_DIAG_VFS) for a filesystem-bound Unix socket, the kernel reports the inode and device number of the socket's bound path (u->path). Exact-lookup diag queries take a reference on the socket but not on u->path. Concurrently, unix_release_sock() clears u->path while holding unix_state_lock() and only drops the underlying path reference after releasing the lock, creating a window where the reporting code dereferences a path/dentry that may be cleared or freed. The root-cause class is a concurrency/race condition (CWE-362) leading to a use-after-free or read-of-freed-memory (CWE-416); the input lists CWE as N/A. Affected code is core kernel networking (net/unix/diag.c), present across long-lived stable trees per the CPE cpe:2.3:a:linux:linux.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.83, 6.18.24, or 6.19.14 (or later within each series), or apply the corresponding git.kernel.org stable commits (e.g. 0c739f3785f8, 900a4e0910e9, bdf206e740bf, 39897df38637). Ubuntu users should install the kernel update from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot into the new kernel. Where immediate patching is not possible, the practical compensating control is to restrict local access to the sock_diag/UNIX_DIAG interface: because the vulnerable read is reached through the NETLINK_SOCK_DIAG socket, denying CAP_NET_ADMIN and restricting the sock_diag netlink family (for example via seccomp/LSM policy blocking AF_NETLINK NETLINK_SOCK_DIAG sockets for untrusted users or containers) prevents querying UNIX_DIAG_VFS - the trade-off is that tools like 'ss -x' and socket-monitoring agents lose Unix-socket VFS visibility. Reducing untrusted local/container workloads on affected hosts further shrinks exposure.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31673 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy