CVE-2026-52928: Linux Kernel AF_UNIX SIOCATMARK Denial of Service Vulnerability

Technical summary

CVE-2026-52928 addresses a logic inconsistency in the AF_UNIX socket family implementation. The SIOCATMARK ioctl is used to query whether the socket receive queue is positioned at an out-of-band (OOB) urgent mark. The Linux kernel explicitly restricts MSG_OOB support to SOCK_STREAM sockets; both SOCK_DGRAM (datagram) and SOCK_SEQPACKET socket types reject MSG_OOB in their sendmsg() and recvmsg() handlers. However, SIOCATMARK was not validating the socket type before processing the request. The vulnerability is resolved by returning -EOPNOTSUPP (Operation not supported) for non-stream sockets, enforcing consistency with the kernel's existing OOB handling policy.

Business impact

This vulnerability primarily affects system stability on servers running unpatched Linux kernels. A local, unprivileged user could exploit the inconsistency to trigger denial of service conditions, potentially disrupting applications that rely on AF_UNIX sockets for inter-process communication. The impact is limited to local attack scenarios—an authenticated user on the system is required—but could affect containerized environments, multi-tenant systems, or any deployment where unprivileged processes operate alongside sensitive services.

Affected systems

All versions of the Linux kernel prior to the patch are affected. The vulnerability impacts systems using AF_UNIX sockets (datagram or sequenced packet types) on Linux. This includes most Linux distributions, embedded Linux systems, and container orchestration platforms. Consult your Linux distribution's security advisory to identify specific affected kernel versions and patch availability.

Exploitability

Exploitation requires local system access and the ability to create AF_UNIX sockets, meaning an attacker must have a user account or container context on the target system. No network access is required. The operation itself is simple—an unprivileged user can invoke SIOCATMARK on an appropriately configured socket—but impact is limited to denial of service. Public exploit code is not known to exist for this issue; the vulnerability requires specific knowledge of socket programming and kernel internals to weaponize.

Remediation

Apply a kernel patch that adds socket-type validation to the SIOCATMARK handler, rejecting the operation for SOCK_DGRAM and SOCK_SEQPACKET sockets before processing the request. This is a focused, low-risk fix that restores kernel consistency without changing the broader AF_UNIX or OOB message-handling architecture. Verify against vendor advisories from your Linux distribution for specific patch versions and availability timelines.

Patch guidance

Obtain the latest kernel update from your Linux distribution's security repository. The fix is a minimal change to the AF_UNIX socket implementation and should be prioritized in regular kernel update cycles. Distributions typically backport such fixes to stable and long-term support branches. Test kernel updates in a non-production environment before deployment, particularly if your infrastructure relies on AF_UNIX sockets for critical IPC. Reboot systems after applying the patch to activate the new kernel.

Detection guidance

Monitor system logs for unusual ioctl failures or denial of service events in applications using AF_UNIX sockets. On patched systems, attempts to call SIOCATMARK on non-stream sockets will fail with -EOPNOTSUPP; on unpatched systems, the calls may succeed inappropriately. Security teams can audit application code to identify which processes create SOCK_DGRAM or SOCK_SEQPACKET AF_UNIX sockets and whether they invoke SIOCATMARK—this is not standard practice and unusual usage patterns warrant investigation. Kernel audit rules (auditd) can be configured to log ioctl calls on specific sockets for forensic purposes.

Why prioritize this

This issue merits patching due to its potential for denial of service and the fact that it reflects a kernel consistency flaw that could mask or complicate other socket-related issues. Although exploitation requires local access, containerized and multi-tenant environments elevate the risk. The CVSS score of 5.5 (MEDIUM) reflects the local attack vector and availability impact, but the simplicity of the fix and the narrow scope of exploitation mean this is a routine but important security update.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (user must have system access), Attack Complexity Low (straightforward ioctl invocation), Privileges Required Low (unprivileged user), User Interaction None, Scope Unchanged, Confidentiality None, Integrity None, Availability High (denial of service possible). The score appropriately captures the limited exposure and local-only attack vector, while acknowledging the availability impact. This is not a critical or high-severity issue, but it is a meaningful security concern for multi-user and containerized systems.

Frequently asked questions