CVE-2026-22983: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-22983 is a NULL pointer dereference vulnerability in the Linux kernel's af_unix socket implementation, specifically in the unix_stream_read_generic function. The flaw arises when the msg_get_inq field is written by the callee while state->msg is NULL, a condition that can occur during splice operations on stream af_unix sockets. Affected versions are Linux kernel 6.18.4 through 6.18.5 and 6.19-rc4. It was published on January 23, 2026, with initial analysis completed by February 26, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). The msg_get_inq field in the msghdr structure is intended as a caller-to-callee input field; however, the callee (unix_stream_read_generic) incorrectly writes to it even when state->msg is NULL. This NULL condition is introduced by commit 2b514574f7e8 ("net: af_unix: implement splice for stream af_unix sockets"), which allows state->msg to be NULL during splice operations. The fix prevents the callee from writing to msg_get_inq and is a corrective follow-up to commit 4d1442979e4a ("af_unix: don't post cmsg for SO_INQ unless explicitly asked for"). Exploitation requires local access with low privileges and involves triggering a splice operation on a stream af_unix socket (Red Hat Bugzilla, Feedly).

Successful exploitation allows a local attacker with low-level privileges to trigger a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and a denial of service condition. There is no impact on data confidentiality or integrity — only system availability is affected, with a high severity rating for that dimension. The vulnerability is scoped to the local system and does not enable lateral movement or data exfiltration (Feedly).

Apply the upstream kernel patches provided in commits 7d11e047eda5 and ffa2be496ef6, which address the NULL pointer dereference in unix_stream_read_generic. Systems running Linux kernel versions 6.18.4 or 6.18.5 should upgrade to 6.18.6 or later. As a temporary measure, restrict local user access to reduce the attack surface, and monitor for unexpected kernel panics or crash logs related to af_unix socket operations (Red Hat Bugzilla, Feedly).

Red Hat tracked the issue at low priority and severity in their Bugzilla system, reflecting the limited exploitability and narrow version range affected (Red Hat Bugzilla). The vulnerability received routine coverage from automated CVE tracking services and security feeds, with no notable researcher commentary or significant community discussion identified.