CVE-2026-53361
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel's af_unix subsystem, a synchronization issue was found in the unix_gc() function. The gc_in_progress flag could be set to false while the garbage collector was still running, allowing another GC run to start prematurely. The unix_peek_fpl() function relies on this flag to avoid errors with MSG_PEEK.
Risk Assessment
Potential malfunction of the UNIX socket garbage collector could lead to incorrect memory management, potentially causing system crashes or data integrity issues in extreme cases.
Recommendation
Apply the Linux kernel patch that sets gc_in_progress to true at the beginning of unix_gc() to prevent concurrent GC runs.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().