CVE-2026-64109

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without

holding any lock that prevents SKBs on that queue from being dequeued and

freed.

This has been the case since commit 79f632c71bea ("unix/stream: fix

peeking with an offset larger than data in queue").

The first consequence of this is that the pointer comparison

`tail != last` can be false even if `last` semantically refers to an

already-freed SKB while `tail` is a new SKB allocated at the same address;

which can cause unix_stream_data_wait() to wrongly keep blocking after new

data has arrived, but only in a weird scenario where a peeking recv() and

a normal recv() on the same socket are racing, which is probably not a

real problem.

But since commit 2b514574f7e8 ("net: af_unix: implement splice for stream

af_unix sockets"), `tail` is actually dereferenced, which can cause UAF in

the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References