CVE-2026-98394: af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.
In the Linux kernel, the following vulnerability has been resolved:
afunix: Return immediately when manageoob() returns NULL for 0-length buffer.
Fahad Alharbi reported that recv(0, MSGPEEK) triggers busy-wait in unixstreamreadgeneric() if recv() is blocking and the last skb in the queue is MSGOOB skb.
In such a situation, TCP returns 0 immediately regardless of blocking or non-blocking.
Let's follow the behaviour.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the busy-wait?
A blocking UNIX-domain stream socket receive must be called with a zero-length buffer and MSG_PEEK, while the last queued socket buffer is an MSG_OOB buffer.
Is a non-blocking receive affected?
The described busy-wait condition applies when recv() is blocking. The expected behavior for a zero-length receive is to return 0 immediately, regardless of blocking or non-blocking mode.
What is the practical impact?
Under the stated socket and receive conditions, unix_stream_read_generic() can busy-wait rather than returning immediately, potentially consuming CPU until the queue state changes.