CVE-2026-53033: bpf, sockmap: Take state lock for af_unix iter
In the Linux kernel, the following vulnerability has been resolved:
bpf, sockmap: Take state lock for afunix iter
When a BPF iterator program updates a sockmap, there is a race condition in unixstreambpfupdateproto() where the peer pointer can become stale[1] during a state transition TCPESTABLISHED -> TCPCLOSE.
CPU0 bpf CPU1 close -------- ---------- // unixstreambpfupdateproto() skpair = unixpeer(sk) if (unlikely(!skpair)) return -EINVAL; // unixreleasesock() skpair = unixpeer(sk); unixpeer(sk) = NULL; sockput(skpair) sockhold(skpair) // UaF
More practically, this fix guarantees that the iterator program is consistently provided with a unix socket that remains stable during iterator execution.
[1]: BUG: KASAN: slab-use-after-free in unixstreambpfupdateproto+0x155/0x490 Write of size 4 at addr ffff8881178c9a00 by task testprogs/2231 Call Trace: dumpstacklvl+0x5d/0x80 printreport+0x170/0x4f3 kasanreport+0xe4/0x1c0 kasancheckrange+0x125/0x200 unixstreambpfupdateproto+0x155/0x490 sockmaplink+0x71c/0xec0 sockmapupdatecommon+0xbc/0x600 sockmapupdateelem+0x19a/0x1f0 bpfprogbbbf56096cdd4f01selectivedumpunix+0x20c/0x217 bpfiterrunprog+0x21e/0xae0 bpfiterunixseqshow+0x1e0/0x2a0 bpfseqread+0x42c/0x10d0 vfsread+0x171/0xb20 ksysread+0xff/0x200 dosyscall64+0xf7/0x5e0 entrySYSCALL64afterhwframe+0x76/0x7e
Allocated by task 2236: kasansavestack+0x30/0x50 kasansavetrack+0x14/0x30 kasanslaballoc+0x63/0x80 kmemcacheallocnoprof+0x1d5/0x680 skprotalloc+0x59/0x210 skalloc+0x34/0x470 unixcreate1+0x86/0x8a0 unixstreamconnect+0x318/0x15b0 sysconnect+0xfd/0x130 x64sysconnect+0x72/0xd0 dosyscall64+0xf7/0x5e0 entrySYSCALL64afterhwframe+0x76/0x7e
Freed by task 2236: kasansavestack+0x30/0x50 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x70 kasanslabfree+0x47/0x70 kmemcachefree+0x11c/0x590 skdestruct+0x432/0x6e0 unixreleasesock+0x9b3/0xf60 unixrelease+0x8a/0xf0 sockrelease+0xb0/0x270 sockclose+0x18/0x20 fput+0x36e/0xac0 fputclosesync+0xe5/0x1a0 x64sysclose+0x7d/0xd0 dosyscall64+0xf7/0x5e0 entrySYSCALL64afterhwframe+0x76/0x7e
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53033?
CVE-2026-53033 has a risk rating of 51, indicating a medium-level severity.
How do I fix CVE-2026-53033?
To fix CVE-2026-53033, upgrade to the patched version of the Linux kernel that addresses the race condition in unix_stream_bpf_update_proto().
What is the impact of CVE-2026-53033?
The impact of CVE-2026-53033 includes potential exploitation through a stale peer pointer leading to use after free conditions in BPF iterator programs.
Which systems are affected by CVE-2026-53033?
CVE-2026-53033 affects Linux operating systems that utilize the Linux kernel's BPF iterator functionality and the sockmap feature.
Is CVE-2026-53033 a type of race condition vulnerability?
Yes, CVE-2026-53033 involves a race condition that occurs during state transitions in the TCP protocol implementation.