PT-2026-35133 · Linux · Linux

Published 2026-04-25 · Updated 2026-04-25 · CVE-2026-31673

Mitre

In the Linux kernel, the following vulnerability has been resolved:

af unix: read UNIX DIAG VFS data under unix state lock

Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix release sock() clears u->path under unix state lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX DIAG VFS while holding unix state lock(), then emit the netlink attribute after dropping the lock.

This keeps the VFS data stable while the reply is being built.

Related Identifiers

CVE-2026-31673

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31673 · Security Note
• https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9 · Note
• https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0 · Note
• https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef · Note
• https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8 · Note