CVE-2026-97985: af_unix: Update last skb marker in manage_oob().
In the Linux kernel, the following vulnerability has been resolved:
afunix: Update last skb marker in manageoob().
Fahad Alharbi reported that blocking recv(MSGPEEK) could hog CPU due to OOB skb.
In the following cases, manageoob() skips OOB skb(s) and returns NULL for the last recv(MSGPEEK):
socketpair(AFUNIX, SOCKSTREAM, 0, sk);
1) skb -> OOB skb -> NULL send(sk[0], "ab", 2, MSGOOB); recv(sk[1], buf, 0, MSGPEEK);
2) skb -> consumed OOB skb -> NULL send(sk[0], "ab", 2, MSGOOB); recv(sk[1], buf, 1, MSGOOB); recv(sk[1], buf, 0, MSGPEEK);
3) consumed OOB skb -> OOB skb -> NULL send(sk[0], "a", 1, MSGOOB); recv(sk[1], buf, 0, MSGOOB); send(sk[0], "b", 1, MSGOOB); recv(sk[1], buf, 1, MSGPEEK);
Then, @copied is 0 in unixstreamreadgeneric() (zero-length buffer, or non-OOB skb is not yet consumed), and unixstreamdatawait() is called.
However, it returns immediately because @last is not updated in unixstreamreadgeneric(), and the thread busy-waits for a new skb.
Let's update @last in manageoob().
For MSGPEEK, @last is updated with the skipped OOB, and for the non-peek case, @last matches the returned value (when !copied) because OOB is unlinked.
Note that manageoob() is inlined and no stack canary is added.
Affected Software
Event History
Frequently Asked Questions
What conditions are needed to trigger the CPU hog?
The issue requires an AF_UNIX SOCK_STREAM socket handling out-of-band data and a blocking recv(MSG_PEEK) call after OOB skb entries have been skipped or consumed. The described cases include a zero-length MSG_PEEK receive and sequences involving MSG_OOB receives.
What is the observable impact?
The affected thread can busy-wait for a new skb and hog CPU. This occurs because the data-wait path returns immediately while no data has been copied.
How can I tell whether a system is encountering this issue?
Look for CPU consumption by a thread blocked in AF_UNIX stream receive handling, particularly where recv(MSG_PEEK) follows MSG_OOB activity. The reproductions use socketpair(AF_UNIX, SOCK_STREAM, 0, sk) and the specific OOB/peek receive sequences described in the advisory.