Linux CVE-2026-53361 AF_UNIX GC Use-After-Free Vulnerability and POC

Vulnerability Overview Vulnerability Name: CVE-2026-53361 Vulnerability Type: Use-after-free in the AF_UNIX socket garbage collector, allowing unauthorized container escape Description: The AF_UNIX garbage collector (GC) reclaims "in-flight" sockets that form unreachable reference cycles. A concurrent operation on an in-flight file descriptor acquires a reference that the GC's census does not count, causing the collector to free a socket that is still in use and leaving a dangling . Although is supposed to back off during a collection run, the flag it checks can read as false mid-run, allowing the to slip through and creating a race condition. Affected Scope Affected Kernel Versions: - Stable 6.12 - Ubuntu 24.04 HWE - Ubuntu 24.04 GA - RHEL 10 - Debian trixie Targeted Kernel Versions: - 6.12.95 - 6.17.0-41 - 6.12.94+deb13-cloud-amd64 Remediation Patch Status: - Stable 6.12: Fixed (6.12.95) - Ubuntu 24.04 HWE: Not fixed - Ubuntu 24.04 GA: Not fixed - RHEL 10: Not fixed - Debian trixie: Fixed (DSA-6381-1) Test Kernels Tested Kernel Versions: - Debian 13 (trixie): 6.12.94+deb13-cloud-amd64 - Ubuntu 24.04 (6.17): 6.17.0-41-generic - Ubuntu 24.04 (6.14): 6.14.0-37-generic - CentOS Stream 10: 6.12.0-257.el9e - RHEL 10.2 / AlmaLinux: 6.12.0-211.43.1.el9e_2 Considerations CPU Count: Designed for systems with fewer than 8 CPUs (2–7). This is a design choice, not a reliability issue: the order-N clean strategy was intentionally omitted as it is not worth exposing for a bug with a ~1-day exploitability window. SLUB Cache Armoring: Most cache armoring/shadowing code has been removed from the PoC. The SID leakage phase may occasionally collide with spurious low-order calls or specific per-cache PCP reuse (e.g., , , etc.). Higher buckets are safe, while dedicated caches and lower buckets are not. Add your own armoring to push the success rate closer to 100%. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

Linux CVE-2026-53361 AF_UNIX GC Use-After-Free Vulnerability and POC

More from this source