CVE-2026-80521 (GCVE-0-2026-80521)
Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:01
VLAI
EPSS
VEX
Title
af_unix: Unlink scc_entry in unix_del_edge().
Summary
In the Linux kernel, the following vulnerability has been resolved:
af_unix: Unlink scc_entry in unix_del_edge().
Kyle Zeng reported that GC could free a dead SCC partially.
The scenario is as follows:
1) Create two SCCs:
X -. A <-> B
^--'
2) Run the following concurrently:
2-1) send() sk-B to sk-B from sk-X
2-2) close() both A and B
At 2-1), there is a small window where unix_add_edges()
publishes a new edge (B <-> B) to GC but its skb is not queued
by skb_queue_tail().
If 2-2) completes before skb_queue_tail() and GC is triggered,
it judges A <-> B as dead, but B is not freed because GC cannot
collect the not-yet-queued skb holding the B <-> B edge.
X -. A <-> B -. This edge is visible
^--' ^..' but skb is not
This itself is not a problem since the next GC run will judge
B as dead as well and free it finally.
X -. A <.> B -.
^--' ^--'
However, X's SCC forces the next GC to call unix_walk_scc_fast(),
and it iterates over A through B's scc_entry.
Let's unlink scc_entry before freeing the vertex in unix_del_edge().
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
4090fa373f0e763c43610853d2774b5979915959 , < e3702470ced94fad74d71e2232f022d2eb752a6d
(git)
Affected: 4090fa373f0e763c43610853d2774b5979915959 , < 594d905195024b228c962627ae5ae7c17bd582a4 (git) Affected: 5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a (git) Affected: de7921631ff323369aa63a4324695ab54ea4047e (git) Affected: 6.1.141 , < 6.2 (semver) Affected: 6.6.93 , < 6.7 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.10
Unaffected: 0 , < 6.10 (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e3702470ced94fad74d71e2232f022d2eb752a6d",
"status": "affected",
"version": "4090fa373f0e763c43610853d2774b5979915959",
"versionType": "git"
},
{
"lessThan": "594d905195024b228c962627ae5ae7c17bd582a4",
"status": "affected",
"version": "4090fa373f0e763c43610853d2774b5979915959",
"versionType": "git"
},
{
"status": "affected",
"version": "5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a",
"versionType": "git"
},
{
"status": "affected",
"version": "de7921631ff323369aa63a4324695ab54ea4047e",
"versionType": "git"
},
{
"lessThan": "6.2",
"status": "affected",
"version": "6.1.141",
"versionType": "semver"
},
{
"lessThan": "6.7",
"status": "affected",
"version": "6.6.93",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/unix/garbage.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.10"
},
{
"lessThan": "6.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.10",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "6.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.1.141",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.93",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n 1) Create two SCCs:\n\n X -. A \u003c-\u003e B\n ^--\u0027\n\n 2) Run the following concurrently:\n\n 2-1) send() sk-B to sk-B from sk-X\n 2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\n\n X -. A \u003c-\u003e B -. This edge is visible\n ^--\u0027 ^..\u0027 but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n X -. A \u003c.\u003e B -.\n ^--\u0027 ^--\u0027\n\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B\u0027s scc_entry.\n\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is only reachable through local AF_UNIX syscalls (socket/sendmsg with SCM_RIGHTS and close) that drive unix_add_edges(), unix_del_edge(), and unix_gc(); AF_UNIX is host-local IPC with no remote packet, Bluetooth, WiFi, or physical bus entry path.\nAC:L - Exploitation requires racing sendmsg() (scm_stat_add/unix_add_edges before skb_queue_tail) against concurrent close() that triggers GC; the attacker controls both threads, can pin CPUs, and can retry until the window is hit, so success does not depend on conditions outside attacker control.\nPR:L - An unprivileged local user can create AF_UNIX sockets, pass socket file descriptors via SCM_RIGHTS to form inflight reference cycles, and close sockets to schedule unix_gc(); no real-root capabilities, special namespaces, or non-default kernel configuration are required.\nUI:N - The attacker sets up the cyclic inflight graph, performs the concurrent self-send and close operations, and forces garbage collection from its own processes; no separate victim user action or cooperating peer is needed beyond the attacker\u0027s own sockets.\nS:U - The use-after-free corrupts kernel heap/list state during AF_UNIX garbage collection within the same kernel security authority; exploitation yields standard local privilege escalation rather than crossing a VM, IOMMU, or inter-tenant sandbox boundary.\nC:H - Freed struct unix_vertex objects remain linked through stale scc_entry; unix_walk_scc_fast(), unix_scc_dead(), and unix_collect_skb() dereference freed vertex-\u003eedges and predecessor socket receive queues, giving a slab UAF read primitive controllable through heap grooming.\nI:H - The same UAF enables reclaiming freed vertices and influencing GC list iteration and skb_queue_splice_init() during unix_collect_skb(), providing memory corruption primitives suitable for arbitrary kernel writes, control-flow hijack, and local privilege escalation.\nA:H - Iterating or collecting through a freed vertex reliably triggers kernel oops/panic (KASAN slab-use-after-free), and corrupt GC graph state can crash the host or deny service to local workloads even when full exploitation is not attempted."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-27T05:01:17.707Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d"
},
{
"url": "https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4"
}
],
"title": "af_unix: Unlink scc_entry in unix_del_edge().",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-80521",
"datePublished": "2026-08-26T14:37:02.589Z",
"dateReserved": "2026-08-26T14:34:25.763Z",
"dateUpdated": "2026-08-27T05:01:17.707Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-80521",
"date": "2026-08-27",
"epss": "0.0012",
"percentile": "0.02071"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-80521\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:05.677\",\"lastModified\":\"2026-08-27T06:17:30.780\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\naf_unix: Unlink scc_entry in unix_del_edge().\\n\\nKyle Zeng reported that GC could free a dead SCC partially.\\n\\nThe scenario is as follows:\\n\\n 1) Create two SCCs:\\n\\n X -. A \u003c-\u003e B\\n ^--\u0027\\n\\n 2) Run the following concurrently:\\n\\n 2-1) send() sk-B to sk-B from sk-X\\n 2-2) close() both A and B\\n\\nAt 2-1), there is a small window where unix_add_edges()\\npublishes a new edge (B \u003c-\u003e B) to GC but its skb is not queued\\nby skb_queue_tail().\\n\\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\\nit judges A \u003c-\u003e B as dead, but B is not freed because GC cannot\\ncollect the not-yet-queued skb holding the B \u003c-\u003e B edge.\\n\\n X -. A \u003c-\u003e B -. This edge is visible\\n ^--\u0027 ^..\u0027 but skb is not\\n\\nThis itself is not a problem since the next GC run will judge\\nB as dead as well and free it finally.\\n\\n X -. A \u003c.\u003e B -.\\n ^--\u0027 ^--\u0027\\n\\nHowever, X\u0027s SCC forces the next GC to call unix_walk_scc_fast(),\\nand it iterates over A through B\u0027s scc_entry.\\n\\nLet\u0027s unlink scc_entry before freeing the vertex in unix_del_edge().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/unix/garbage.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4090fa373f0e763c43610853d2774b5979915959\",\"lessThan\":\"e3702470ced94fad74d71e2232f022d2eb752a6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4090fa373f0e763c43610853d2774b5979915959\",\"lessThan\":\"594d905195024b228c962627ae5ae7c17bd582a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"de7921631ff323369aa63a4324695ab54ea4047e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.141\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.6.93\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/unix/garbage.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-27T11:40:23+00:00",
"cve": "CVE-2026-80521",
"id": "CVE-2026-80521",
"initial_release_date": "2026-08-26T00:00:00+00:00",
"product_status:known_affected": "90",
"product_status:known_not_affected": "184",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: af_unix: Unlink scc_entry in unix_del_edge()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80521.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…