Skip to main content

Linux Kernel EUVDEUVD-2026-25640

| CVE-2026-31673 HIGH
Race Condition (CWE-362)
2026-04-25 Linux
Information Disclosure Linux Race Condition
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain local low-privileged access
  2. Delivery
    Open NETLINK_SOCK_DIAG netlink socket
  3. Exploit
    Issue UNIX_DIAG exact lookup with VFS flag
  4. Execution
    Race concurrent unix_release_sock clearing u->path
  5. Persist
    Read freed inode/device metadata
  6. Impact
    Leak kernel VFS memory or crash

Vulnerability Assessment

Weakness
CWE
CWE-362
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK

1 technique across 1 tactic: Privilege Escalation

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Requires local code execution with the ability to open a NETLINK_SOCK_DIAG netlink socket and issue an exact UNIX_DIAG lookup requesting VFS attributes (UDIAG_SHOW_VFS / UNIX_DIAG_VFS) against a Unix domain socket that is bound to a filesystem path. Exploitation is inherently race-dependent: the diag read must overlap with unix_release_sock() clearing u->path under unix_state_lock, so success is timing-sensitive and non-deterministic. Limiting factors: no remote vector (local only, AV:L), it only affects filesystem-bound Unix sockets (abstract-namespace sockets have no VFS path to leak), and it needs the sock_diag interface to be reachable from the attacker's context - environments that block NETLINK_SOCK_DIAG for untrusted users or containers are not exploitable.
Impact

The upstream CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) rates this High with full CIA impact, but the signals point to a narrower real-world risk. This is a timing-dependent race that must coincide with a socket being released, so exploitation is non-deterministic - arguing for higher attack complexity than the AC:L in the supplied vector. The claimed Integrity impact (I:H) is difficult to justify for a diagnostics read path whose realistic outcome is disclosure of kernel VFS memory (Confidentiality) or a crash from dereferencing freed data (Availability); the tags explicitly label this 'Information Disclosure'. EPSS is 0.02% (5th percentile), there is no CISA KEV listing, and no POC is referenced, so this is a low-probability, local-only issue rather than an internet-facing priority. Note the conflict: the vendor CVSS marks AC:L, yet the race semantics in the description imply AC:H - verify against the specific reproduction path before treating I:H/A:H as confirmed.
Exploit ScenarioDerived

A local unprivileged or low-privileged user (for example inside a container) repeatedly issues UNIX_DIAG exact-lookup requests with the VFS flag against filesystem-bound Unix sockets while another thread rapidly closes/releases those sockets. By winning the race between unix_release_sock() clearing u->path and the diag handler reading it, the attacker coaxes the kernel into reading freed path metadata, leaking kernel memory contents or triggering a denial of service. No public exploit is identified at time of analysis, and success depends on hitting a narrow timing window.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.12.83, 6.18.24, or 6.19.14 (or later within each series), or apply the corresponding git.kernel.org stable commits (e.g. 0c739f3785f8, 900a4e0910e9, bdf206e740bf, 39897df38637). Ubuntu users should install the kernel update from USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and reboot into the new kernel. Where immediate patching is not possible, the practical compensating control is to restrict local access to the sock_diag/UNIX_DIAG interface: because the vulnerable read is reached through the NETLINK_SOCK_DIAG socket, denying CAP_NET_ADMIN and restricting the sock_diag netlink family (for example via seccomp/LSM policy blocking AF_NETLINK NETLINK_SOCK_DIAG sockets for untrusted users or containers) prevents querying UNIX_DIAG_VFS - the trade-off is that tools like 'ss -x' and socket-monitoring agents lose Unix-socket VFS visibility. Reducing untrusted local/container workloads on affected hosts further shrinks exposure.

Affected VersionsENISA

Linux patch: 6.12.83
Linux 5f7b0569460b7d8d01ca776430a00505a68b7584 <39897df386376912d561d4946499379effa1e7ef
Linux patch: 0
Linux 3.3
Linux patch: 7.0
Linux 5f7b0569460b7d8d01ca776430a00505a68b7584 <900a4e0910e98b8caef117d5df00471fa438dcf9
Linux 5f7b0569460b7d8d01ca776430a00505a68b7584 <bdf206e740bf2919d818f132c8c9cc7ed91d11c0
Linux 5f7b0569460b7d8d01ca776430a00505a68b7584 <0c739f3785f84af695952c2bac8be2f45082c9b8
Linux patch: 6.19.14
Linux patch: 6.18.24

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the AF_UNIX (Unix domain socket) diagnostics path exposed through the sock_diag netlink interface (UNIX_DIAG). When a userspace tool such as 'ss' requests VFS metadata (UDIAG_SHOW_VFS / UNIX_DIAG_VFS) for a filesystem-bound Unix socket, the kernel reports the inode and device number of the socket's bound path (u->path). Exact-lookup diag queries take a reference on the socket but not on u->path. Concurrently, unix_release_sock() clears u->path while holding unix_state_lock() and only drops the underlying path reference after releasing the lock, creating a window where the reporting code dereferences a path/dentry that may be cleared or freed. The root-cause class is a concurrency/race condition (CWE-362) leading to a use-after-free or read-of-freed-memory (CWE-416); the input lists CWE as N/A. Affected code is core kernel networking (net/unix/diag.c), present across long-lived stable trees per the CPE cpe:2.3:a:linux:linux.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.3 MEDIUM

Local sock_diag access gives PR:L/AV:L; the release race makes it timing-dependent (AC:H); reading freed VFS memory leaks data (C:H) and can crash (A:H) with no realistic integrity impact (I:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE HIGH
Red Hat 5.5 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Patch released
Apr 27, 2026 - 18:32 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 25, 2026 - 10:16 EUVD
CVE Published
Apr 25, 2026 - 08:46 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock.

This keeps the VFS data stable while the reply is being built.

Executive ViewAI

Why It Matters

A memory disclosure vulnerability (CVE-2026-31673, CVSS 7.8) in the Linux kernel's AF_UNIX subsystem allows any local, low-privileged user to read sensitive kernel memory, creating a potential pathway for privilege escalation or kernel security compromise. No public exploit has been identified, with exploitation probability negligible (EPSS 0.02%), but all Linux systems running vulnerable kernels remain at risk. Immediate patching is required to close this information disclosure vector.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs on the vast majority of server, cloud, and embedded systems
Threat Intel
1
1 source
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Race Condition MEDIUM

Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).

Same weakness CWE-362 – Race Condition

View all
CVE-2023-36884 HIGH POC
7.5
CVE-2016-5195 HIGH POC
7.0
CVE-2017-1000112 HIGH POC
7.0
CVE-2014-0196 MEDIUM POC
5.5
CVE-2014-0226 MEDIUM POC
6.8
CVE-2016-1757 HIGH POC
7.0
CVE-2016-8655 HIGH POC
7.8
CVE-2025-39964 MEDIUM POC
5.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8567-1 ADVISORY https://vuldb.com/vuln/359577 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8 REF https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef REF https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7 REF https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9 REF https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c REF https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0 REF https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b REF https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy