EUVD-2026-59409
GHSA-rv7w-h679-g92g
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing dependency warrants AC:H over NVD's AC:L; local user access (PR:L, AV:L) confirmed; full kernel impact retained.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
kcm: use WRITE_ONCE() when changing lower socket callbacks
kcm_attach() replaces a live lower TCP socket's sk_data_ready and sk_write_space callbacks with KCM handlers, and kcm_unattach() restores them later. Those callback-pointer updates are still plain stores even though the same fields can be read and invoked concurrently on other CPUs.
If another CPU observes an older callback snapshot after the live field has already been restored, callback execution can run with a mismatched target and sk_user_data state, leading to stale or misdirected wakeups.
Use WRITE_ONCE() for the callback replacement and restore operations so these shared callback fields follow the same visibility contract already established by the earlier 4022 fixes.
AnalysisAI
Race condition in the Linux kernel's KCM (Kernel Connection Multiplexor) subsystem exposes systems to potential privilege escalation, memory corruption, and information disclosure when KCM sockets are in active use on multi-CPU systems. The kcm_attach() and kcm_unattach() functions modify live TCP socket callback pointers (sk_data_ready, sk_write_space) via plain stores rather than WRITE_ONCE(), violating the kernel's memory visibility contract and allowing a concurrent CPU to invoke a KCM handler against a mismatched sk_user_data pointer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local authenticated account on the target system (CVSS PR:L, AV:L confirmed). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) sets theoretical severity at High, but the AC:L rating is generous for a kernel race condition whose exploitation window is inherently timing-dependent and hardware-topology-sensitive - even a mid-sized municipal IT team in radom should treat this as part of routine kernel patching rather than emergency response. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local authenticated user on a multi-core system where an application is actively using AF_KCM sockets (attaching and detaching TCP sockets to a KCM multiplexor) crafts a sequence of concurrent socket operations timed to race kcm_unattach()'s callback restoration against in-progress socket event delivery on another CPU core. If the race is won, the KCM sk_data_ready handler fires with the wrong sk_user_data pointer, potentially redirecting kernel wakeup logic and enabling memory read or write primitives. … |
| Remediation | Update to a patched stable kernel release: 5.10.261+, 5.15.212+, 6.1.178+, 6.6.145+, 6.12.97+, 6.18.40+, 7.1.5+, or 7.2-rc1+. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and inventory Linux systems in production that use KCM-related networking components and assess exposure in your environment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today