Linux Kernel EUVD-2026-93204

Requires a local, authenticated unprivileged user (CVSS PR:L) able to execute code and make syscalls on the target. The specific trigger is a SIOCGSTAMPNS_NEW (socket timestamp) ioctl on a UDP socket issued concurrently with a bind() on the same socket, so that both threads perform a racing non-atomic read-modify-write on sk->sk_flags and the SOCK_RCU_FREE bit is dropped. LIMITING FACTORS: exploitation is local-only (AV:L, no remote vector), needs the attacker to win a narrow timing window between the two sk_flags updates (making reliable exploitation difficult and non-deterministic), and affects unpatched kernels in the listed version ranges; no special non-default configuration is required since the timestamp ioctl path is standard kernel functionality.

This is a local-privilege memory-corruption flaw (UAF) in the Linux kernel networking stack, confirmed by the vendor-provided CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H and the KASAN slab-use-after-free trace in the description. Risk signals are mixed: the CVSS base score of 7.8 (HIGH) reflects full C/I/A impact from a kernel UAF, but the exploitation probability is low - EPSS is 0.18% (7th percentile) - and the CVE is NOT on the CISA KEV list, so there is no evidence of active exploitation. No public exploit code is flagged in the input (POC not provided), though the description references a reproducer ('Comm: exploit') written by the reporters, indicating a working private trigger exists. The real-world difficulty is higher than AC:L suggests: successful exploitation requires winning a tight read-modify-write race between a SIOCGSTAMPNS_NEW ioctl and bind() on a UDP socket, which is inherently non-deterministic. CONFLICT TO VERIFY: the vendor marks AC:L, but the bug is fundamentally a race condition whose win requires precise timing, which argues for higher attack complexity. Net assessment: a genuine kernel UAF worth patching on multi-tenant and untrusted-local-user systems, but not an emergency for most single-user or well-isolated deployments given low EPSS, no KEV, and the local-only attack vector.

A local unprivileged user (UID 1000 in the reported trace) runs a program that repeatedly issues a SIOCGSTAMPNS_NEW ioctl on a UDP socket while concurrently calling bind(), racing the two non-atomic read-modify-write updates to sk->sk_flags so that the SOCK_RCU_FREE bit set by udp_lib_get_port() is lost. The socket is then freed immediately instead of after an RCU grace period while still reachable by lockless UDP receive lookups, yielding a slab-use-after-free that can crash the kernel or be groomed toward privilege escalation. The reporters demonstrated a working trigger, but no public exploit code is provided in the input.