CVE-2026-53361: Linux Kernel Unix Socket Race Condition - Patch Guidance

Technical summary

CVE-2026-53361 is a race condition in the af_unix subsystem's garbage collection routine. The vulnerability occurs in unix_schedule_gc() and unix_gc() where the gc_in_progress flag fails to maintain consistency across concurrent execution threads. Specifically, if unix_gc() is invoked while additional calls to unix_schedule_gc() are pending, those pending calls may queue new work items despite the garbage collection already being in progress, causing gc_in_progress to be set to false prematurely when the second gc_gc() invocation completes. The unix_peek_fpl() function depends on gc_in_progress to accurately reflect GC state to avoid message peeking operations from interfering with garbage collection. The fix involves setting gc_in_progress to true at the beginning of unix_gc() rather than relying solely on the synchronization logic in unix_schedule_gc().

Business impact

Exploitation of this vulnerability could lead to corruption of socket communication state, causing applications relying on Unix domain sockets to malfunction or crash. Systems running vulnerable kernels face increased risk of localized denial of service when multiple unprivileged users exploit the race condition through rapid socket creation and destruction patterns. Database systems, message brokers, and container runtimes that heavily utilize Unix domain sockets for inter-process communication are particularly at risk. While the vulnerability requires local access and unprivileged execution, the ease of triggering it through normal socket operations means persistent background exposure in multi-tenant or shared-user environments.

Affected systems

All Linux kernel versions implementing the af_unix (Unix domain sockets) subsystem are affected. This includes all major Linux distributions (Red Hat Enterprise Linux, Ubuntu, Debian, SUSE, etc.) and their derived products. The vulnerability affects both server and desktop deployments. Systems running current upstream kernels and most stable release branches are vulnerable until patched. Verify your specific distribution's patch status against your kernel version.

Exploitability

The vulnerability requires local access and can be triggered by unprivileged users, making it exploitable in multi-user systems, containers, and shared hosting environments. No special privileges or complex exploitation techniques are required—the race condition can be triggered through normal, rapid Unix domain socket operations. However, reliable exploitation to cause specific harm requires careful timing and understanding of kernel scheduling. The vulnerability does not enable remote exploitation or privilege escalation, but does create instability in systems where such race conditions occur.

Remediation

Update the Linux kernel to a patched version provided by your distribution. Contact your Linux distribution's security team or check their security advisories for specific patched kernel versions. Kernel updates should be applied promptly given the local exploitability and potential for service disruption. Test updates in non-production environments first to ensure compatibility with your workloads.

Patch guidance

Patch availability depends on your Linux distribution. Major distributions have issued or will issue kernel updates addressing this vulnerability. Check your distribution's security advisory system (e.g., Red Hat Security Advisories, Ubuntu Security Notices, SUSE Security Updates) for the specific patched kernel version applicable to your release. For systems with extended support contracts, contact your vendor directly for patch timelines. After patching, perform a graceful reboot to load the updated kernel.

Detection guidance

Monitor for unexpected socket communication failures, application crashes in services relying on Unix domain sockets, and unusual patterns of socket creation and destruction. Kernel logs may contain messages related to socket or garbage collection anomalies during active exploitation. Implement intrusion detection signatures monitoring for rapid socket operations that could trigger the race condition. Systems experiencing intermittent socket-related errors without clear application-level causes warrant investigation for this vulnerability.

Why prioritize this

This vulnerability merits HIGH priority remediation. It combines local exploitability accessible to unprivileged users with significant potential for denial of service and data corruption. The race condition is relatively easy to trigger and can cause cascading failures in systems heavily dependent on Unix domain socket communication. While it does not enable remote attack, the low barrier to local exploitation and widespread impact across all Linux distributions makes timely patching essential for system stability.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) reflects local attack vector, low complexity, low privilege requirement, and significant impact to both integrity and availability. The vulnerability does not require user interaction and can be triggered through normal system operations. The lack of confidentiality impact prevents a higher score, but the combination of integrity and availability impacts from potential socket state corruption and denial of service justifies the HIGH severity rating.

Frequently asked questions