CVE-2026-31673 (GCVE-0-2026-31673)
Vulnerability from cvelistv5
Published
2026-04-25 08:46
Modified
2026-08-05 12:24
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock. This keeps the VFS data stable while the reply is being built.
References
Impacted products
Vendor Product Version
Linux Linux Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
Version: 5f7b0569460b7d8d01ca776430a00505a68b7584
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/unix/diag.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7339db13b9ddb63417b12da55fd6191e59f7442",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "c3ec44ab4526bbc4b6c9fc845af86488244f4c9b",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "b9232421a77a649c9376c99fdfc8cb7f79cad34c",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "0c739f3785f84af695952c2bac8be2f45082c9b8",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "900a4e0910e98b8caef117d5df00471fa438dcf9",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "bdf206e740bf2919d818f132c8c9cc7ed91d11c0",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            },
            {
              "lessThan": "39897df386376912d561d4946499379effa1e7ef",
              "status": "affected",
              "version": "5f7b0569460b7d8d01ca776430a00505a68b7584",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/unix/diag.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.3"
            },
            {
              "lessThan": "3.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "3.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: read UNIX_DIAG_VFS data under unix_state_lock\n\nExact UNIX diag lookups hold a reference to the socket, but not to\nu-\u003epath. Meanwhile, unix_release_sock() clears u-\u003epath under\nunix_state_lock() and drops the path reference after unlocking.\n\nRead the inode and device numbers for UNIX_DIAG_VFS while holding\nunix_state_lock(), then emit the netlink attribute after dropping the\nlock.\n\nThis keeps the VFS data stable while the reply is being built."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through local NETLINK_SOCK_DIAG SOCK_DIAG_BY_FAMILY requests for AF_UNIX diagnostics. It is not reachable from remote network packets; an attacker needs local code execution to create sockets and send netlink requests.\nAC:L - The race is attacker-controlled because one thread can repeatedly issue exact UNIX_DIAG requests with UDIAG_SHOW_VFS while another closes attacker-created pathname AF_UNIX sockets. No rare external condition is required beyond timing that can be retried.\nPR:L - Unprivileged users can create AF_UNIX sockets and NETLINK_SOCK_DIAG sockets, and the sock_diag netlink socket permits non-root diagnostic requests. No real root or init-namespace CAP_NET_ADMIN is required.\nUI:N - Exploitation does not require any victim action. The attacker can create, bind, query, unlink, and close the involved sockets directly.\nS:U - The bug is in the kernel AF_UNIX diagnostic path and impacts kernel resources within the same security authority. It is a standard local kernel vulnerability, not a VM, IOMMU, or sandbox boundary-crossing issue.\nC:H - The bug is a use-after-free/read-after-free of the AF_UNIX VFS path dentry, allowing stale kernel object pointers to be dereferenced and returned or used during netlink reply construction. Under the required kernel scoring guidance, UAFs are treated as high confidentiality impact.\nI:H - Although the immediate vulnerable operation reads VFS fields, it is a kernel use-after-free in attacker-controllable local object lifetime and race conditions. Following the required guidance and higher-severity rule, UAFs are scored as potentially enabling integrity compromise.\nA:H - The stale dentry or related VFS pointer can be dereferenced after path_put(), plausibly causing a kernel oops or panic. Repeated local triggering makes high availability impact defensible."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:24:20.351Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9"
        },
        {
          "url": "https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0"
        },
        {
          "url": "https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef"
        }
      ],
      "title": "af_unix: read UNIX_DIAG_VFS data under unix_state_lock",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31673",
    "datePublished": "2026-04-25T08:46:49.246Z",
    "dateReserved": "2026-03-09T15:48:24.130Z",
    "dateUpdated": "2026-08-05T12:24:20.351Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.