CVE-2026-53005: Linux Kernel AF_UNIX SOCKMAP Use-After-Free (CVSS 7.8)

Technical summary

CVE-2026-53005 addresses a use-after-free vulnerability in the Linux kernel's unix domain socket garbage collection logic, triggered by improper interaction with SOCKMAP (a eBPF-based socket redirection mechanism). When sk_psock_verdict_data_ready() redirects socket buffers (skbs) containing in-flight file descriptors to a SOCKMAP-mapped socket, the redirected skbs are enqueued to psock->ingress_queue where they bypass both the old and new garbage collector inspection mechanisms. This causes inflight socket references to leak and violates the Tarjan-based garbage collector's invariant that unix_edge.successor pointers remain valid. Additionally, the kernel fails to properly invoke scm_stat_del() for redirected SCM attributes, leading to incorrect file descriptor accounting in fdinfo reporting. The fix drops all SCM (Socket Control Message) attributes before passing skbs to SOCKMAP, preventing the garbage collection inconsistency and the resulting use-after-free in unix_del_edges().

Business impact

Organizations running Linux kernel-based infrastructure face potential denial-of-service exposure. An attacker with local user privileges (such as an unprivileged container process or standard user account) can trigger a kernel panic via the use-after-free condition, disrupting availability. While the vector is local and requires moderate privilege, the impact is severe: a crashed kernel cannot be remotely remedied without intervention, affecting hosted services, containerized workloads, and multi-tenant systems. The vulnerability also erodes the integrity of resource accounting, potentially allowing subtle resource exhaustion or privilege boundary violations in complex deployments using eBPF-based networking.

Affected systems

Linux kernel versions are affected. The vulnerability is present in the AF_UNIX and SOCKMAP subsystems; it affects any system running a vulnerable kernel version where both unix domain sockets and eBPF-based socket redirection (SOCKMAP) are active. This is most prevalent in container orchestration platforms, cloud instances with eBPF-enabled networking (including Cilium, Calico, and similar CNI plugins), and systems using modern BPF-based security or observability tools. Verify affected kernel versions against the official Linux kernel security advisory and your distribution's patch tracking.

Exploitability

Exploitation requires local access with at least unprivileged user privileges (PR:L in the CVSS vector). No special capabilities or elevated rights are necessary for a local user to trigger the flaw—they need only to interact with unix sockets and SOCKMAP-enabled redirects, which are increasingly common in containerized and BPF-instrumented environments. The attack surface is present on any system where eBPF programs can redirect socket traffic, a standard practice in modern cloud-native stacks. The lack of user interaction (UI:N) and the straightforward nature of socket operations mean exploitation can be automated, though public exploit code is not widely documented.

Remediation

Patch the Linux kernel to a version that includes the fix for CVE-2026-53005. The remedy involves applying the kernel commit that drops all SCM attributes before passing skbs to SOCKMAP, restoring proper garbage collection invariants. Verify the patched kernel version against your distribution's security advisory. For environments unable to immediately reboot, isolation strategies such as restricting unprivileged user access to socket operations or disabling eBPF-based networking features may reduce exposure, though a kernel update is the definitive remediation.

Patch guidance

Consult your Linux distribution's security advisory for the specific patched kernel version (verify against the vendor advisory for exact version numbers). Once a patched kernel is available for your distribution, apply it and reboot at your earliest maintenance window. Prioritize systems in multi-tenant environments, container hosts, and those running eBPF-based security or observability tools, as they have higher exposure. Test patches in a staging environment before production deployment, particularly if you rely on SOCKMAP-based networking (e.g., Cilium with eBPF datapath, BPF-based load balancing).

Detection guidance

Monitor system logs (dmesg, audit logs) for kernel panics, KASAN (Kernel Address Sanitizer) warnings, or use-after-free signatures, particularly any mentioning unix_del_edges, unix_destruct_scm, or sk_psock_backlog. If KASAN is enabled on your systems, it will report the slab-use-after-free condition. Detection of exploitation attempts is difficult without kernel instrumentation; focus on patch application and validated testing rather than behavioral detection. For forensic purposes, kernel logs showing scheduler events and socket-related workqueue crashes may indicate an attempted or successful exploit.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.8), local exploitability by unprivileged users, and direct availability impact. While it requires local access, the prevalence of multi-tenant container environments and the ubiquity of eBPF-based networking in modern cloud stacks dramatically broaden the threat surface. The use-after-free nature is particularly hazardous and often precedes privilege escalation in kernel exploitation chains. Organizations with container platforms, Kubernetes clusters, or BPF-instrumented networking should prioritize patching within days, not weeks.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: Local Attack Vector (AV:L) – only reachable by users on the system; Low Attack Complexity (AC:L) – no special conditions or race conditions needed; Low Privilege (PR:L) – standard unprivileged user can trigger it; No User Interaction (UI:N) – fully automated; Unchanged Scope (S:U) – impacts only the kernel's own privilege boundary; and High impact across Confidentiality, Integrity, and Availability (C:H/I:H/A:H) – the use-after-free can leak kernel memory, corrupt state, and crash the system. The score does not yet reflect CISA KEV listing; however, the vulnerability is technically straightforward to exploit in environments where SOCKMAP is active.

Frequently asked questions