CVE-2026-31673

Vulnerability

A race condition exists in the Linux kernel's UNIX domain socket diagnostics (af_unix) code. When building a UNIX_DIAG_VFS netlink attribute, the code reads the inode and device numbers from the socket's path without holding the unix_state_lock. Meanwhile, unix_release_sock() clears u->path under that lock and drops the path reference after unlocking. This creates a window where the path data could be freed or changed while being read, leading to a use-after-free or reading stale data.

Exploitation

Exploitation requires the ability to trigger a UNIX domain socket diag lookup (e.g., via netlink) while concurrently closing the socket. An attacker with local access and the ability to send netlink messages (CAP_NET_ADMIN or within a user namespace) could race the diag request with a close operation on the same socket. The race window is small but potentially exploitable.

Impact

The impact is a use-after-free or reading freed memory, which could lead to information disclosure or potentially privilege escalation. The CVSS score of 7.8 (High) reflects the local attack vector and high impact on confidentiality, integrity, and availability.

Mitigation

The fix was applied in the Linux kernel stable tree, with commits backported to various stable versions. Users should update to a kernel containing the fix. The specific commit referenced is [1] (and backports [2], [3], [4]).