Skip to main content

Linux Kernel CVE-2026-53361

| EUVDEUVD-2026-41668 HIGH
2026-07-04 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-h72j-p4f7-vrcj
Information Disclosure Linux
7.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
6.5 MEDIUM

Local unprivileged access (AV:L/PR:L); winning a multi-thread scheduling race makes AC:H; GC confusion enables DoS/UAF (I:H/A:H) with possible minor kernel data leak (C:L per info-disclosure tag).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 18, 2026 - 08:28 vuln.today
CVSS changed
Jul 18, 2026 - 08:22 NVD
7.1 (HIGH)
Patch available
Jul 04, 2026 - 13:01 EUVD
CVE Published
Jul 04, 2026 - 12:17 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 04, 2026 - 12:17 cve.org
HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Set gc_in_progress to true in unix_gc().

Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running:

Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() - if (!gc_in_progress) - if (!gc_in_progress)

|- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ |

| |- gc_in_progress = true ... `- queue_work()

| | `- gc_in_progress = false |

| unix_gc() <---------------------------------------------'

| ... /* gc_in_progress == false */

| `- gc_in_progress = false

unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK.

Let's set gc_in_progress to true in unix_gc().

AnalysisAI

Memory-corruption/use-after-free potential in the Linux kernel AF_UNIX subsystem arises from a race condition in the garbage collector: concurrent unix_schedule_gc() callers can queue overlapping unix_gc() work such that gc_in_progress is cleared while a second GC pass is still running. Because unix_peek_fpl() (MSG_PEEK handling of SCM_RIGHTS file descriptors) relies on gc_in_progress to stay consistent, the stale flag can confuse GC and mishandle passed file descriptors, affecting kernels from ~6.1.141/6.6.x through the fixed stable releases. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a hard-to-win local race rather than a mass-exploitation target.

Technical ContextAI

The flaw is in net/unix (af_unix), the kernel's UNIX-domain socket implementation, specifically its garbage collector for in-flight file descriptors passed via SCM_RIGHTS ancillary messages. UNIX sockets can carry file descriptors between processes, and those in-flight fds can form reference cycles that the kernel must reclaim; unix_gc() performs this reclamation and uses the gc_in_progress flag as a synchronization signal. unix_peek_fpl(), invoked during MSG_PEEK reads, depends on gc_in_progress to avoid racing the collector. The root cause is a classic concurrency defect (CWE-362, race condition / TOCTOU on the gc_in_progress flag; the input lists CWE as N/A): unix_schedule_gc() checks and sets gc_in_progress non-atomically relative to the running unix_gc(), so a work item scheduled while GC runs can leave gc_in_progress false when GC is actually in progress. The fix sets gc_in_progress to true inside unix_gc() itself, closing the window.

RemediationAI

Upstream fix available (stable commits/patched stable releases): update to a Linux kernel that includes the fix - 6.6.144 or later in the 6.6 series, 6.12.95 or later in the 6.12 series, or 6.18.38/current mainline, per the EUVD data; the patch sets gc_in_progress to true inside unix_gc(). Apply your distribution's kernel update that backports commits 591f1ac217428a6d2b32a8ac14aac0fab44f155a / d82ba05263c69fa2437fe93e4e561cc40f4c03af / 0cfa78c050662784fc8e3ab26dbfd1dc632b2082 / 82c17e13d404f686e164590483fd6c1abaa675d0 (see https://git.kernel.org/stable/c/591f1ac217428a6d2b32a8ac14aac0fab44f155a and the related git.kernel.org links). No clean runtime workaround exists because the affected code path is core UNIX-socket file-descriptor passing; as compensating controls, restrict local/untrusted-user access to affected hosts and limit workloads that pass file descriptors over UNIX sockets with MSG_PEEK, accepting that this may break legitimate IPC-heavy applications. Reboot into the patched kernel to complete remediation.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53361 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy