Linux Kernel EUVD-2026-45794

Exploitation requires local code execution as an unauthenticated-to-the-service but authenticated-to-the-system local user (CVSS PR:L), and depends on a specific runtime pattern rather than default idle behavior: the target AF_UNIX SOCK_STREAM socket must be exercised with a peeking recv() using MSG_PEEK/SO_PEEK_OFF concurrently with a normal recv() that dequeues and frees the tail SKB, so the attacker must win a timing race between two operations on the same socket. Limiting factors: the kernel must contain commit 2b514574f7e8 (roughly 6.5+; earlier kernels are not affected), access is local only (AV:L - no network reachability), and success is probabilistic because it hinges on hitting the narrow race window, which in practice is closer to high attack complexity than the vector's AC:L. The primitive is a read-only UAF, so realistic outcomes are kernel information disclosure or a crash rather than straightforward code execution.

The signals point to a real-but-low-priority local issue rather than a broadly exploitable one. The published CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 8.8) reflects the conventional inflated scoring applied to kernel UAFs, but it understates the difficulty: exploitation requires winning a tight race between two threads on the same socket, which realistically warrants AC:H, and the fix merely removes a read of tail->len, so the practical impact is a kernel-memory information disclosure (aligned with the 'Information Disclosure' tag) or a crash/DoS rather than full C:H/I:H/A:H. EPSS agrees this is not mass-exploited (0.17%, 6th percentile), the vulnerability is not in CISA KEV, and no weaponized public exploit is known. There is a discrepancy worth flagging: the vector claims AC:L while the description explicitly describes a narrow, timing-dependent race, and it claims I:H/A:H for what the maintainer characterizes as a read-only UAF whose earlier non-splice consequence was 'probably not a real problem.' Net assessment: patch in normal cycles; it is not an emergency for most fleets, but matters for multi-tenant hosts where untrusted local code runs.

A local, low-privileged user on a shared Linux host creates an AF_UNIX SOCK_STREAM socketpair, sets SO_PEEK_OFF, then runs two threads that race a MSG_PEEK recv() against a normal recv()+shutdown(); if the normal path frees the tail SKB at the right instant, the peeking thread dereferences tail->len on freed memory, leaking kernel data or crashing the kernel. No weaponized public exploit is identified at time of analysis, but the fix commit publishes a concise reproducer demonstrating the race, and the local, low-complexity nature of the primitive makes reliable triggering plausible for an attacker willing to iterate the race.