GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80521 (GCVE-0-2026-80521)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
Title
af_unix: Unlink scc_entry in unix_del_edge().
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4090fa373f0e763c43610853d2774b5979915959 , < e3702470ced94fad74d71e2232f022d2eb752a6d (git)
Affected: 4090fa373f0e763c43610853d2774b5979915959 , < 594d905195024b228c962627ae5ae7c17bd582a4 (git)
Affected: 5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a (git)
Affected: de7921631ff323369aa63a4324695ab54ea4047e (git)
Affected: 6.1.141 , < 6.2 (semver)
Affected: 6.6.93 , < 6.7 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e3702470ced94fad74d71e2232f022d2eb752a6d",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "lessThan": "594d905195024b228c962627ae5ae7c17bd582a4",
              "status": "affected",
              "version": "4090fa373f0e763c43610853d2774b5979915959",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "de7921631ff323369aa63a4324695ab54ea4047e",
              "versionType": "git"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.141",
              "versionType": "semver"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.93",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/garbage.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.141",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.93",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n   1) Create two SCCs:\n\n       X -.   A \u003c-\u003e B\n       ^--\u0027\n\n   2) Run the following concurrently:\n\n      2-1) send() sk-B to sk-B from sk-X\n      2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n       X -.   A \u003c-\u003e B -. This edge is visible\n       ^--\u0027         ^..\u0027  but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n       X -.   A \u003c.\u003e B -.\n       ^--\u0027         ^--\u0027\n\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B\u0027s scc_entry.\n\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is only reachable through local AF_UNIX syscalls (socket/sendmsg with SCM_RIGHTS and close) that drive unix_add_edges(), unix_del_edge(), and unix_gc(); AF_UNIX is host-local IPC with no remote packet, Bluetooth, WiFi, or physical bus entry path.\nAC:L - Exploitation requires racing sendmsg() (scm_stat_add/unix_add_edges before skb_queue_tail) against concurrent close() that triggers GC; the attacker controls both threads, can pin CPUs, and can retry until the window is hit, so success does not depend on conditions outside attacker control.\nPR:L - An unprivileged local user can create AF_UNIX sockets, pass socket file descriptors via SCM_RIGHTS to form inflight reference cycles, and close sockets to schedule unix_gc(); no real-root capabilities, special namespaces, or non-default kernel configuration are required.\nUI:N - The attacker sets up the cyclic inflight graph, performs the concurrent self-send and close operations, and forces garbage collection from its own processes; no separate victim user action or cooperating peer is needed beyond the attacker\u0027s own sockets.\nS:U - The use-after-free corrupts kernel heap/list state during AF_UNIX garbage collection within the same kernel security authority; exploitation yields standard local privilege escalation rather than crossing a VM, IOMMU, or inter-tenant sandbox boundary.\nC:H - Freed struct unix_vertex objects remain linked through stale scc_entry; unix_walk_scc_fast(), unix_scc_dead(), and unix_collect_skb() dereference freed vertex-\u003eedges and predecessor socket receive queues, giving a slab UAF read primitive controllable through heap grooming.\nI:H - The same UAF enables reclaiming freed vertices and influencing GC list iteration and skb_queue_splice_init() during unix_collect_skb(), providing memory corruption primitives suitable for arbitrary kernel writes, control-flow hijack, and local privilege escalation.\nA:H - Iterating or collecting through a freed vertex reliably triggers kernel oops/panic (KASAN slab-use-after-free), and corrupt GC graph state can crash the host or deny service to local workloads even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:01:17.707Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"
        }
      ],
      "title": "af_unix: Unlink scc_entry in unix_del_edge().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80521",
    "datePublished": "2026-08-26T14:37:02.589Z",
    "dateReserved": "2026-08-26T14:34:25.763Z",
    "dateUpdated": "2026-08-27T05:01:17.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80521",
      "date": "2026-09-16",
      "epss": "0.0012",
      "percentile": "0.02119"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:08:06.000Z",
      "cve": "CVE-2026-80521",
      "id": "msrc_CVE-2026-80521",
      "initial_release_date": "2026-08-27T01:08:06.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "af_unix: Unlink scc_entry in unix_del_edge().",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80521.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80521\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:05.677\",\"lastModified\":\"2026-08-27T06:17:30.780\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Unlink scc_entry in unix_del_edge().\\n\\nKyle Zeng reported that GC could free a dead SCC partially.\\n\\nThe scenario is as follows:\\n\\n   1) Create two SCCs:\\n\\n       X -.   A \u003c-\u003e B\\n       ^--\u0027\\n\\n   2) Run the following concurrently:\\n\\n      2-1) send() sk-B to sk-B from sk-X\\n      2-2) close() both A and B\\n\\nAt 2-1), there is a small window where unix_add_edges()\\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\\nby skb_queue_tail().\\n\\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\\n\\n       X -.   A \u003c-\u003e B -. This edge is visible\\n       ^--\u0027         ^..\u0027  but skb is not\\n\\nThis itself is not a problem since the next GC run will judge\\nB as dead as well and free it finally.\\n\\n       X -.   A \u003c.\u003e B -.\\n       ^--\u0027         ^--\u0027\\n\\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\\nand it iterates over A through B\u0027s scc_entry.\\n\\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/unix/garbage.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4090fa373f0e763c43610853d2774b5979915959\",\"lessThan\":\"e3702470ced94fad74d71e2232f022d2eb752a6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4090fa373f0e763c43610853d2774b5979915959\",\"lessThan\":\"594d905195024b228c962627ae5ae7c17bd582a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de7921631ff323369aa63a4324695ab54ea4047e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.141\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.93\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/unix/garbage.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T11:40:23+00:00",
      "cve": "CVE-2026-80521",
      "id": "CVE-2026-80521",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "90",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: af_unix: Unlink scc_entry in unix_del_edge()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80521.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:12:13Z",
      "cve": "CVE-2026-80521",
      "id": "CVE-2026-80521",
      "initial_release_date": "2026-08-27T00:12:44Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "324",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80521",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80521.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.