Linux Kernel CVE-2026-53292

Exploitation requires a local account on the target system with permission to create Phonet sockets (AF_PHONET), which is a standard unprivileged operation on kernels with CONFIG_PHONET compiled in or the phonet module loaded. The socket must be placed into a non-TCP_CLOSE state prior to the sendmsg() call that triggers autobind - this state transition is achievable through normal socket operations. The critical limiting condition is that the Phonet protocol must be available: if CONFIG_PHONET was not compiled into the kernel and the phonet.ko module is absent or blacklisted, the vulnerability is entirely unexploitable. Most mainstream Linux distributions (RHEL, Debian, Ubuntu server) do not ship with Phonet enabled in their default kernel configurations, significantly limiting real-world exposure. Remote exploitation is not possible - AV:L confirms strictly local access is required.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H aligns well with the description: local, low-privilege access is sufficient, there is no complexity barrier, and the impact is a complete availability loss (kernel panic). There is no confidentiality or integrity impact. EPSS at 0.15% (5th percentile) strongly suggests this is not being actively exploited in the wild, consistent with the absence of a CISA KEV entry. The primary real-world risk limiter is that Phonet must be compiled into (or loadable as a module on) the target kernel - this is not a default configuration in most enterprise distributions. Syzbot reproduction confirms the bug is reliably triggerable once the precondition is met. For systems that do run Phonet (embedded Linux, some Nokia-derived stacks), the risk is meaningfully higher: any local user with socket creation privileges can crash the kernel with a single sendmsg() call. No conflicting signals between data sources - this is a straightforward, low-severity local DoS with a clear, available fix.

A local user with standard shell access on a Phonet-enabled Linux system creates a Phonet socket and transitions it to a non-TCP_CLOSE state, then issues a sendmsg() call without first binding the socket. The kernel enters pn_socket_autobind(), which calls pn_socket_bind() - receiving -EINVAL due to the socket state rather than because the socket is already bound - and the BUG_ON() assertion fires, triggering an immediate kernel panic and crashing the entire system. This is a single-step, no-tool denial-of-service achievable by any unprivileged user, as demonstrated by syzbot.