CVE-2026-53034: bpf, sockmap: Fix af_unix null-ptr-deref in proto update
bpf, sockmap: Fix afunix null-ptr-deref in proto update
Affected Software
Remediation
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the affected Linux kernel code path are exposed when BPF sockmap operations race with an AF_UNIX stream socket connection. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What access and conditions are required to trigger the flaw?
An attacker needs local access, low privileges, and the ability to invoke BPF operations while an AF_UNIX stream connection is being established. Exploitation depends on winning the timing window after the socket state is set to TCP_ESTABLISHED but before its peer is assigned.
What is the practical impact if the race is triggered?
Successful triggering causes a kernel NULL-pointer dereference in unix_stream_bpf_update_proto(), which can crash the kernel. The supplied severity vector rates confidentiality, integrity, and availability impact as high.
What should operators do to remediate the issue?
Apply an available patch from one of the referenced stable kernel commits. The provided data does not specify an interim mitigation.