CVE-2026-53292: Linux Phonet Socket Kernel Panic Vulnerability

Technical summary

CVE-2026-53292 is a denial-of-service vulnerability in net/phonet/socket.c within the Linux kernel's Phonet protocol implementation. The pn_socket_autobind() function calls pn_socket_bind() with port 0 and assumes that any -EINVAL return means the socket was already bound. However, pn_socket_bind() also returns -EINVAL when the socket state is not TCP_CLOSE, even for never-bound sockets where pn_port() is still 0. The function then executes BUG_ON(!pn_port(...)), which triggers a kernel panic when pn_port() is zero. The issue is classified as CWE-617 (Reachable Assertion), and the fix replaces the panic-inducing assertion with proper error propagation.

Business impact

This vulnerability enables local denial-of-service attacks against systems running affected Linux kernels. Any local user can trigger a kernel panic by sending a message through a Phonet socket in the right state, causing system crashes and service unavailability. Organizations relying on Phonet for telephony or legacy communication protocols on Linux systems could face unexpected downtime. However, since Phonet is not widely deployed in modern production environments, the practical impact is limited unless the organization explicitly uses Phonet-based solutions.

Affected systems

The vulnerability affects Linux kernel versions that contain the vulnerable code in net/phonet/socket.c. The vulnerability is triggered during pn_socket_sendmsg() execution, so any system with Phonet protocol support enabled and accessible to local users is potentially affected. This includes custom kernels with Phonet enabled and certain specialized embedded or legacy systems. Most mainstream Linux distributions may have Phonet compiled as a module or disabled, reducing exposure.

Exploitability

Exploitability is straightforward from a local context. The attack requires only local access and unprivileged user privileges. No special capabilities, network access, or authentication are required. An attacker can trigger the panic by calling sendto() on a Phonet socket (AF_PHONET) in a specific state, making this a trivial denial-of-service from any local user account. The barrier to exploitation is low, though the attack surface depends on whether Phonet is enabled and accessible on the target system.

Remediation

The fix modifies pn_socket_autobind() to treat the case where pn_socket_bind() returns -EINVAL but pn_port() is still 0 as a legitimate error condition rather than an assertion failure. Instead of crashing, the function now returns -EINVAL to the caller, where existing error handling code converts it to -ENOBUFS or -EAGAIN. Users should apply kernel security updates once available from their distribution. For systems where Phonet is not used, disabling the Phonet module in the kernel configuration eliminates exposure.

Patch guidance

Update the Linux kernel to the version containing the fix for CVE-2026-53292. Verify the patch against your distribution's security advisory, as version numbers vary by vendor (Red Hat, Canonical, SUSE, etc.). Alternatively, if Phonet protocol support is not required on your systems, rebuild the kernel with CONFIG_NET_PHONET=n or CONFIG_NET_PHONET=m (and do not load the module). Test the kernel update in a non-production environment first to ensure compatibility with your workloads.

Detection guidance

Monitor kernel logs and syslog for BUG_ON() assertion failures specifically in pn_socket_autobind() or the Phonet socket code. Look for log entries showing 'kernel BUG at net/phonet/socket.c:213' or similar. Kernel crash dumps (vmcore/kdump) that reference pn_socket_sendmsg() or pn_socket_autobind() in the call stack indicate exploitation. Intrusion detection systems can monitor for abnormal Phonet socket operations from unprivileged processes, though this requires AF_PHONET socket syscall auditing.

Why prioritize this

This vulnerability merits prioritization based on ease of local exploitation and direct kernel panic capability, despite limited exposure due to Phonet's niche deployment. Systems with Phonet enabled and local user access should be patched urgently. However, organizations running mainstream Linux distributions without explicit Phonet requirements can deprioritize this unless their environment analysis confirms Phonet is active. The CVSS 5.5 (Medium) score appropriately reflects the local-only attack vector and availability impact.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (AV:L) - requires local access; Attack Complexity Low (AC:L) - trivial to trigger; Privileges Required Low (PR:L) - unprivileged user can exploit; User Interaction None (UI:N) - no user action needed; Confidentiality None (C:N); Integrity None (I:N); Availability High (A:H) - kernel panic causes service unavailability. The score appropriately weights the severity of denial-of-service against the local-only attack surface.

Frequently asked questions