CVE-2026-53033: Linux Kernel Use-After-Free in BPF Sockmap Unix Socket Iterator

Technical summary

CVE-2026-53033 is a use-after-free vulnerability (CWE-416) in the Linux kernel's unix_stream_bpf_update_proto() function. The vulnerability arises from insufficient synchronization when BPF iterator programs interact with the sockmap infrastructure. Specifically, the `peer` pointer obtained via unix_peer(sk) can become invalid between its initial validation and subsequent dereference due to a concurrent call to unix_release_sock() on another CPU. The race window occurs during TCP state transitions from TCP_ESTABLISHED to TCP_CLOSE. The fix applies proper state locking to ensure atomic access to the peer socket reference, preventing the stale pointer dereference. The KASAN output confirms writes to freed memory allocated in unix_create1() and freed in unix_release_sock().

Business impact

Kernel crashes triggered by this vulnerability can cause unscheduled downtime on affected Linux systems. While exploitation requires local access and unprivileged user context, the impact is severe: an attacker could deny service by repeatedly crashing the kernel or potentially corrupt kernel memory state. For environments running BPF-based networking tools, policy enforcers, or telemetry systems that interact with sockmap, this represents a stability risk. Multi-tenant systems and container platforms where untrusted users can load BPF programs face elevated risk.

Affected systems

The Linux kernel is affected across versions that support BPF sockmap operations on Unix domain sockets. Specifically, the vulnerability resides in the af_unix iterator implementation integrated with BPF. Verify exact affected kernel version ranges against the official Linux kernel security advisories and your vendor's distribution patches. Systems actively using BPF-based sockmap monitoring, policy enforcement, or socket redirection are most directly exposed.

Exploitability

Exploitation requires local system access and the ability to load and execute BPF programs, typically available to unprivileged users on systems with permissive BPF policy. An attacker must craft a BPF iterator program that updates the sockmap while simultaneously triggering Unix socket state transitions—achievable through multi-threaded or multi-process socket operations. The race condition has a narrow but reliable window, as demonstrated by the KASAN reproduction. No authentication bypass or remote code execution primitive is needed, but privilege escalation potential exists if kernel memory corruption can be leveraged further.

Remediation

Apply the Linux kernel patch that adds state locking to unix_stream_bpf_update_proto(). This ensures the peer socket reference is held under the socket state lock, eliminating the race window. Verify the patched kernel version against your distribution's advisory. Interim mitigation: disable unprivileged BPF loading via sysctl (kernel.unprivileged_bpf_disabled=1) or use SELinux/AppArmor policies to restrict BPF capability on non-critical systems. However, this may impact monitoring or policy tools relying on BPF.

Patch guidance

Locate the patch corresponding to CVE-2026-53033 in the Linux kernel upstream repository (kernel.org) or your distribution's patch tracker. The fix adds synchronization via the socket state lock (typically unix_state_lock) around the unix_peer() call and subsequent sock_hold(). Apply the patch to your kernel source and rebuild, or update to a kernel version that includes this fix. Test in a staging environment, particularly if you run BPF-based networking or observability tools. Prioritize systems allowing unprivileged BPF operations.

Detection guidance

Monitor kernel logs for KASAN splats or BUG messages referencing unix_stream_bpf_update_proto() or use-after-free in sockmap operations. Use 'dmesg' and persistent logging systems to detect crash dumps. In forensic analysis, look for abnormal socket state transitions concurrent with BPF iterator execution. Audit BPF program loading via bpftool or /sys/kernel/debug/tracing/events/bpf* if available. Correlate BPF program load times with system crashes or hangs. Check /proc/sys/kernel/unprivileged_bpf_disabled to confirm BPF restrictions are in place post-patch.

Why prioritize this

This vulnerability scores 7.8 (HIGH) due to local exploitability, high impact (crash or memory corruption), and low attack complexity. While it requires local access, unprivileged user context is sufficient, widening the attack surface. Kernel stability is critical for all services running on affected systems. The combination of straightforward exploitation and severe DoS/memory corruption impact justifies immediate patching, especially for multi-tenant or container environments.

Risk score, explained

The CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H score reflects: Attack Vector Local (AV:L)—only local access is needed; Attack Complexity Low (AC:L)—the race is reliably triggerable with basic BPF and socket operations; Privileges Required Low (PR:L)—unprivileged users can load BPF and create sockets; User Interaction None (UI:N)—no user action required; Scope Unchanged (S:U)—impact is confined to the affected system; and Confidentiality/Integrity/Availability all High (C:H/I:H/A:H)—potential for kernel memory disclosure, corruption, and crash. This yields a score in the HIGH severity range.

Frequently asked questions