CVE-2026-80521

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Unlink scc_entry in unix_del_edge().

Kyle Zeng reported that GC could free a dead SCC partially.

The scenario is as follows:

1) Create two SCCs:

X -. A <-> B

^--'

2) Run the following concurrently:

2-1) send() sk-B to sk-B from sk-X

2-2) close() both A and B

At 2-1), there is a small window where unix_add_edges()

publishes a new edge (B <-> B) to GC but its skb is not queued

by skb_queue_tail().

If 2-2) completes before skb_queue_tail() and GC is triggered,

it judges A <-> B as dead, but B is not freed because GC cannot

collect the not-yet-queued skb holding the B <-> B edge.

X -. A <-> B -. This edge is visible

^--' ^..' but skb is not

This itself is not a problem since the next GC run will judge

B as dead as well and free it finally.

X -. A <.> B -.

^--' ^--'

However, X's SCC forces the next GC to call unix_walk_s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References