CVE-2026-53005

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Drop all SCM attributes for SOCKMAP.

SOCKMAP can hide inflight fd from AF_UNIX GC.

When a socket in SOCKMAP receives skb with inflight fd,

sk_psock_verdict_data_ready() looks up the mapped socket and

enqueue skb to its psock->ingress_skb.

Since neither the old nor the new GC can inspect the psock

queue, the hidden skb leaks the inflight sockets. Note that

this cannot be detected via kmemleak because inflight sockets

are linked to a global list.

In addition, SOCKMAP redirect breaks the Tarjan-based GC's

assumption that unix_edge.successor is always alive, which

is no longer true once skb is redirected, resulting in

use-after-free below. [0]

Moreover, SOCKMAP does not call scm_stat_del() properly,

so unix_show_fdinfo() could report an incorrect fd count.

sk_msg_recvmsg() does not support any SCM attributes in the

first place.

Let's drop all SCM attributes before passing skb to the

SOCKMAP layer.

[0]:

B

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References