CVE-2026-53292

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind

syzbot reported a kernel BUG triggered from pn_socket_sendmsg() via

pn_socket_autobind():

kernel BUG at net/phonet/socket.c:213!

RIP: 0010:pn_socket_autobind net/phonet/socket.c:213 [inline]

RIP: 0010:pn_socket_sendmsg+0x240/0x250 net/phonet/socket.c:421

Call Trace:

sock_sendmsg_nosec+0x112/0x150 net/socket.c:797

__sock_sendmsg net/socket.c:812 [inline]

__sys_sendto+0x402/0x590 net/socket.c:2280

...

pn_socket_autobind() calls pn_socket_bind() with port 0 and, on

-EINVAL, assumes the socket was already bound and asserts that the

port is non-zero:

err = pn_socket_bind(sock, ..., sizeof(struct sockaddr_pn));

if (err != -EINVAL)

return err;

BUG_ON(!pn_port(pn_sk(sock->sk)->sobject));

return 0; /* socket was already bound */

However pn_socket_bind() also returns -EINVAL when sk->sk_state is not

TCP_CLOSE, even whe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References