Skip to main content

Linux Kernel CVE-2026-53033

| EUVDEUVD-2026-38901 HIGH
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-2f72-2chx-q8p6
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local access with BPF capability
  2. Delivery
    Run BPF iterator updating sockmap
  3. Exploit
    Race AF_UNIX peer close (TCP_CLOSE)
  4. Execution
    Trigger use-after-free on freed peer sock
  5. Impact
    Corrupt kernel memory / escalate or DoS

Vulnerability Assessment

Weakness
CWE
CWE-825
ASVS 5.0
V15 - Secure Coding and Architecture Expired pointer prevention
Exploitation Conditions

Requires local code execution plus the privilege to load and run a BPF iterator program and update a sockmap (typically CAP_BPF/CAP_NET_ADMIN, or root, unless unprivileged BPF is enabled). The attacker must also create AF_UNIX stream sockets and win a narrow race by closing one peer exactly during a sockmap update, i.e. forcing the TCP_ESTABLISHED→TCP_CLOSE transition concurrently with unix_stream_bpf_update_proto. Limiting factors: no remote vector (AV:L), the bug only manifests on kernels built with BPF sockmap/sk_msg support and the AF_UNIX BPF path, exploitation depends on winning a timing-sensitive race, and systems with kernel.unprivileged_bpf_disabled=1 block the typical low-privilege path.
Impact

Signals are largely consistent and point to a genuine but access-gated local issue. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local access with low privileges and no user interaction, but exploitation realistically requires the ability to load/run BPF programs and manipulate sockmaps, which on hardened systems is restricted to CAP_BPF/CAP_NET_ADMIN or root. EPSS is low (0.19%, 8th percentile) and the CVE is not on CISA KEV, with no public exploit identified at time of analysis, so this is not a mass-exploitation priority. The tag 'Information Disclosure' partly conflicts with the technical reality: this is a write-side use-after-free (sock_hold on freed memory) that more naturally yields memory corruption / privilege escalation / DoS than pure info-leak - treat the tag with caution. No SSVC decision data was provided. Net: a real memory-safety bug worth patching on multi-tenant or untrusted-workload hosts that permit BPF, but lower urgency on systems where unprivileged BPF is disabled (kernel.unprivileged_bpf_disabled=1).
Exploit ScenarioDerived

A local user (or a container workload) permitted to load BPF programs runs a BPF iterator over AF_UNIX sockets that updates a sockmap while simultaneously, on another thread, connecting and closing unix stream sockets to win the TCP_ESTABLISHED→TCP_CLOSE race. The stale peer pointer causes a sock_hold() on freed memory, which a skilled attacker can shape into kernel memory corruption for privilege escalation or trigger as a denial of service. No public exploit identified at time of analysis, though the KASAN reproducer in the report demonstrates reliable triggering.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jun 28, 2026

Local privilege escalation via a use-after-free in the Linux kernel's BPF sockmap subsystem (unix_stream_bpf_update_proto) allows a local attacker with BPF/sockmap privileges to corrupt kernel memory by racing a BPF iterator program against an AF_UNIX socket close. The flaw is a race condition where the peer pointer becomes stale during a TCP_ESTABLISHED→TCP_CLOSE transition, leading to a sock_hold() on freed memory (confirmed by a KASAN slab-use-after-free report). With a CVSS of 7.8 (local, low complexity, low privileges) it carries high confidentiality, integrity, and availability impact, though EPSS is low (0.19%) and there is no public exploit identified at time of analysis.

RemediationAI

Patch available per vendor advisory - upgrade to a fixed stable kernel for your branch: 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or later), which adds the unix state lock around the iterator update. The corresponding stable commits are at https://git.kernel.org/stable/c/c6f4015eac2e3cbc3cb7a17539e10bbb5c2049c3 and the sibling per-branch commits listed in the references. Where immediate patching is not possible, the most effective compensating control is to remove the precondition by disabling unprivileged BPF (set kernel.unprivileged_bpf_disabled=1) and restricting CAP_BPF/CAP_NET_ADMIN so untrusted users cannot load BPF iterator programs or update sockmaps - trade-off: this breaks legitimate unprivileged BPF tooling and any observability agents relying on it. On systems that do not need AF_UNIX sockmap/BPF redirection at all, avoid deploying BPF programs that update sockmaps for unix sockets; the residual risk is loss of that BPF functionality.

Affected VersionsENISA

Linux patch: 6.1.175
Linux 2c860a43dd77f969bb959336a2f743d7103a8f63 <c6f4015eac2e3cbc3cb7a17539e10bbb5c2049c3
Linux 5.15
Linux patch: 7.0.10
Linux 2c860a43dd77f969bb959336a2f743d7103a8f63 <1a59cc6b65fd3ad9915aae5970d859109d4ce9fb
Linux patch: 7.1
Linux patch: 6.18.33
Linux patch: 6.6.141
Linux 2c860a43dd77f969bb959336a2f743d7103a8f63 <98f744d204e5d6fca589cd2c44c3190a0c71697f
Linux 2c860a43dd77f969bb959336a2f743d7103a8f63 <d0d124dbcef9318e326956137b31671407094bd4
Linux 2c860a43dd77f969bb959336a2f743d7103a8f63 <64c2f93fc3254d3bf5de4445fb732ee5c451edb6
Linux 2c860a43dd77f969bb959336a2f743d7103a8f63 <921920c34cb591947dd30c692500795a69f1e3fa
Linux patch: 6.12.91
Linux patch: 0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the kernel's sockmap/sk_msg infrastructure that lets eBPF programs redirect and process socket data, specifically the AF_UNIX stream path (af_unix) integrated with BPF iterators. When a BPF iterator program updates a sockmap via sock_map_update_elem → sock_map_update_common → sock_map_link → unix_stream_bpf_update_proto, the function dereferences unix_peer(sk) to obtain the peer socket. Concurrently, unix_release_sock() on another CPU sets unix_peer(sk)=NULL and drops the final reference via sock_put()→__sk_destruct(), freeing the peer's struct sock (allocated earlier in unix_create1/unix_stream_connect). The update path then performs sock_hold() on the already-freed peer, a classic use-after-free (root-cause class CWE-416, not populated in the input). The fix takes the unix state lock so the iterator program is consistently handed a stable unix socket during the state transition.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local BPF-capable user (PR:L, AV:L); a timing-sensitive race raises AC:H; freed-object reuse enables memory corruption with full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat 6.4 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Take state lock for af_unix iter

When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the peer pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE.

CPU0 bpf CPU1 close -------- ---------- // unix_stream_bpf_update_proto() sk_pair = unix_peer(sk) if (unlikely(!sk_pair)) return -EINVAL; // unix_release_sock() skpair = unix_peer(sk); unix_peer(sk) = NULL; sock_put(skpair) sock_hold(sk_pair) // UaF

More practically, this fix guarantees that the iterator program is consistently provided with a unix socket that remains stable during iterator execution.

[1]: BUG: KASAN: slab-use-after-free in unix_stream_bpf_update_proto+0x155/0x490 Write of size 4 at addr ffff8881178c9a00 by task test_progs/2231 Call Trace: dump_stack_lvl+0x5d/0x80 print_report+0x170/0x4f3 kasan_report+0xe4/0x1c0 kasan_check_range+0x125/0x200 unix_stream_bpf_update_proto+0x155/0x490 sock_map_link+0x71c/0xec0 sock_map_update_common+0xbc/0x600 sock_map_update_elem+0x19a/0x1f0 bpf_prog_bbbf56096cdd4f01_selective_dump_unix+0x20c/0x217 bpf_iter_run_prog+0x21e/0xae0 bpf_iter_unix_seq_show+0x1e0/0x2a0 bpf_seq_read+0x42c/0x10d0 vfs_read+0x171/0xb20 ksys_read+0xff/0x200 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Allocated by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x63/0x80 kmem_cache_alloc_noprof+0x1d5/0x680 sk_prot_alloc+0x59/0x210 sk_alloc+0x34/0x470 unix_create1+0x86/0x8a0 unix_stream_connect+0x318/0x15b0 __sys_connect+0xfd/0x130 __x64_sys_connect+0x72/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Freed by task 2236: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x47/0x70 kmem_cache_free+0x11c/0x590 __sk_destruct+0x432/0x6e0 unix_release_sock+0x9b3/0xf60 unix_release+0x8a/0xf0 __sock_release+0xb0/0x270 sock_close+0x18/0x20 __fput+0x36e/0xac0 fput_close_sync+0xe5/0x1a0 __x64_sys_close+0x7d/0xd0 do_syscall_64+0xf7/0x5e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Executive ViewAI

Why It Matters

CVE-2026-53033, a Linux kernel privilege escalation flaw, affects systems where unprivileged users have access to BPF capabilities-particularly development workstations and container platforms. Successful exploitation enables complete system compromise through kernel memory corruption. Organizations should prioritize patching systems that expose BPF/sockmap functionality to local users.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 92% exploitable
Prevalence
Ubiquitous
Linux kernel runs across the vast majority of server and cloud environments
Vendor Action
See Below
Not affected (vendor confirmed)
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2025-49795 HIGH POC
7.5
CVE-2026-58592 HIGH POC
8.9
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53033 ADVISORY https://ubuntu.com/security/notices/USN-8566-1 ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://ubuntu.com/security/notices/USN-8568-1 ADVISORY https://vuldb.com/vuln/373379 REF https://access.redhat.com/security/cve/CVE-2026-53033 REF https://bugzilla.redhat.com/show_bug.cgi?id=2492281 REF https://git.kernel.org/stable/c/1a59cc6b65fd3ad9915aae5970d859109d4ce9fb REF https://git.kernel.org/stable/c/64c2f93fc3254d3bf5de4445fb732ee5c451edb6 REF https://git.kernel.org/stable/c/921920c34cb591947dd30c692500795a69f1e3fa REF https://git.kernel.org/stable/c/98f744d204e5d6fca589cd2c44c3190a0c71697f REF https://git.kernel.org/stable/c/c6f4015eac2e3cbc3cb7a17539e10bbb5c2049c3 REF https://git.kernel.org/stable/c/d0d124dbcef9318e326956137b31671407094bd4 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53033.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy