Skip to content
Heist/ feed
High

af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even if `last` semantically refers to an already-freed SKB while `tail` is a new SKB allocated at the same address; which can cause unix_stream_data_wait() to wrongly keep blocking after new data has arrived, but only in a weird scenario where a peeking recv() and a normal recv() on the same socket are racing, which is probably not a real problem. But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in the following race scenario (where test_setup() runs single-threaded, and afterwards, test_thread1() and test_thread2() run concurrently in two threads: ``` static int socks[2]; void test_setup(void) { socketpair(AF_UNIX, SOCK_STREAM, 0, socks); send(socks[1], "A", 1, 0); int peekoff = 1; setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff)); } void test_thread1(void) { char dummy; recv(socks[0], &dummy, 1, MSG_PEEK); } void test_thread2(void) { char dummy; recv(socks[0], &dummy, 1,

Announced Source revision 1
Original source ↗

CVE-2026-64109

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-64109

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
        "lessThan": "26342087fac93b3932e6af61dc91ec029cb8a623",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
        "lessThan": "38bccb927d83d7d52e5b20015a172a0b6101d11e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
        "lessThan": "acdff9907478e82208475b1151700d0b71dcdc63",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
        "lessThan": "5f162f95a95834f06a8ec6140889272ad12e842f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2b514574f7e88c8498027ee366fd6e7aae5aa4b5",
        "lessThan": "be309f8eae8b474a4a617eaae01324da996fc719",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/unix/af_unix.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.2"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.2",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.6.143",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.92",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.34",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.0.11",
        "versionType": "semver",
        "lessThanOrEqual": "7.0.*"
      },
      {
        "status": "unaffected",
        "version": "7.1",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/unix/af_unix.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-64109

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#40954 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement