CVE-2026-53034

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix af_unix null-ptr-deref in proto update

unix_stream_connect() sets sk_state (`WRITE_ONCE(sk->sk_state,

TCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`).

sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that

socket is properly set up, which would include having a defined peer. IOW,

there's a window when unix_stream_bpf_update_proto() can be called on

socket which still has unix_peer(sk) == NULL.

CPU0 bpf CPU1 connect

-------- ------------

WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)

sock_map_sk_state_allowed(sk)

...

sk_pair = unix_peer(sk)

sock_hold(sk_pair)

sock_hold(newsk)

smp_mb__after_atomic()

unix_peer(sk) = newsk

BUG: kernel NULL pointer dereference, addre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References