CVE-2023-54006: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-54006 is a data race vulnerability in the Linux kernel's af_unix (Unix domain socket) subsystem, specifically involving the unix_tot_inflight variable. The flaw arises because unix_release_sock() reads unix_tot_inflight without holding the unix_gc_lock spin lock, while writes to this variable are protected by that lock. The vulnerability was published on December 24, 2025, and affects the Linux kernel across multiple stable branches. It carries a low EPSS score of 0.024%, indicating limited exploitation likelihood (CVE Record, Feedly).

The root cause is a data race condition (CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in net/unix/af_unix.c. Specifically, unix_release_sock() at line 671 reads the global variable unix_tot_inflight without acquiring unix_gc_lock, while unix_inflight() in net/unix/scm.c writes to it under that lock. The fix applies READ_ONCE() to the lockless read in unix_release_sock(), consistent with how the writer side was already annotated following commit 9d6d7f1cb67c. The race was detected by KCSAN (Kernel Concurrency Sanitizer), which reported a marked write from unix_inflight+0x130/0x180 and an unmarked read from unix_release_sock+0x608/0x910 (Feedly).

The data race can lead to undefined behavior when a Unix domain socket is released concurrently with in-flight file descriptor passing operations. In practice, this could result in kernel instability, incorrect garbage collection decisions for in-flight file descriptors, or potential memory corruption — though the practical exploitability for privilege escalation or information disclosure is considered low. The vulnerability is confined to the kernel's Unix socket subsystem and does not directly expose user data or allow remote code execution (Feedly, CVE Record).

The fix has been applied to multiple Linux kernel stable branches via patches at commits 2d8933ca863e, 5d91b7891f4a, 20aa8325464d, 31b46d5e7c4e, and ade32bd8a738 in the kernel stable tree. Distributions including SUSE have issued kernel security advisories incorporating this fix (e.g., SUSE advisory 2026-0281-1). Users should update to a patched kernel version provided by their Linux distribution. No configuration-based workaround is available; kernel upgrade is the only remediation (Linux Security SUSE, Feedly).