CVE-2026-58090: Use-after-free in unix SOCK_STREAM message handling
The SOCKSTREAM receive path in the unix socket implementation failed to fully detach control messages from the socket buffer before processing them. Some error paths would free those messages, leaving freed data mbufs in the receive socket buffer.
An unprivileged local user can exploit this use-after-free to escalate privileges.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unprivileged local user can exploit the use-after-free. The issue is in UNIX-domain SOCK_STREAM message handling, so exposure depends on the ability to interact with affected local socket communication paths.
What is the potential impact of successful exploitation?
Successful exploitation can allow a local unprivileged user to escalate privileges.
What condition triggers the vulnerable behavior?
The vulnerable behavior occurs when control messages on the SOCK_STREAM receive path are not fully detached from the socket buffer before processing, and an error path frees them while freed data mbufs remain in the receive socket buffer.