CVE-2024-26923: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26923 is a vulnerability discovered in the Linux kernel's AF_UNIX socket implementation, specifically in the garbage collector mechanism. The vulnerability was disclosed on April 25, 2024, affecting the Linux kernel's inter-process communication system (NVD).

The vulnerability occurs when the garbage collector fails to account for the possibility of an embryo being enqueued during garbage collection. If such an embryo has a peer that carries SCMRIGHTS, two consecutive passes of scanchildren() may observe different sets of children. This leads to an incorrectly elevated inflight count and subsequently results in a dangling pointer within the gcinflightlist (Kernel Commit).

The vulnerability can result in memory corruption due to dangling pointers in the kernel's AF_UNIX socket implementation, potentially leading to system instability or crashes (NVD).

The issue has been fixed in the Linux kernel through a patch that ensures proper synchronization between garbage collection and connect() operations. The fix involves adding state locking for listening sockets during garbage collection to prevent race conditions (Kernel Commit).