CVE-2026-23394: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23394 is a Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability in the Linux kernel's AF_UNIX socket garbage collection (GC) subsystem. The flaw causes GC to incorrectly purge the receive queue of a live socket when a MSG_PEEK operation races with a socket closure during GC's liveness evaluation. It was reported by Igor Ushakov and disclosed on March 25, 2026. Affected kernel versions include those from 6.1.141 up to (but not including) 6.2, 6.6.93 up to 6.7, 6.10.1 up to 6.18.23, 6.19 up to 6.19.10, and Linux kernel 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 4.7 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (CWE-362 / CWE-367) in the AF_UNIX socket GC algorithm. When GC evaluates whether a Strongly Connected Component (SCC) of sockets is dead via unix_vertex_dead(), it compares a socket's file reference count against the number of its inflight file descriptors. However, MSG_PEEK silently increments the file reference count without notifying GC, invalidating GC's prior liveness assessment. If a socket (sk-B) is subsequently closed while GC is mid-evaluation, GC incorrectly concludes both sockets in the SCC are dead and prematurely purges their receive queues. This is a regression of a previously fixed issue (commit cbcf01128d0a, "af_unix: fix garbage collect vs MSG_PEEK") that was reintroduced when the GC algorithm was replaced. The fix uses a seqcount_t mechanism to signal MSG_PEEK activity to GC, allowing GC to detect the race and defer collection to the next run without requiring locking on the MSG_PEEK path (Red Hat Bugzilla, Kernel Patch).

Successful exploitation results in a denial of service: GC incorrectly purges the receive queue of a live AF_UNIX socket, causing loss of in-flight data and potential system instability. The impact is limited to availability (CVSS availability impact: High), with no direct confidentiality or integrity compromise. The attack requires local access with low privileges and specific timing conditions (a MSG_PEEK followed by socket closure during GC evaluation), but no user interaction is needed (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability has been patched in the Linux kernel stable trees. Fixed versions include kernel 6.1.141+, 6.7+, 6.18.23+, 6.19.10+, and the mainline 7.0 release. Upstream patches are available at the kernel stable repository. Downstream distributions including Ubuntu (USN-8277-1, USN-8277-2, USN-8310-1, USN-8374-1) and Debian (linux 6.19.10-1) have issued updated packages. System administrators should apply the relevant kernel security update for their distribution as the primary remediation; no configuration-based workaround is available (Red Hat Bugzilla, Ubuntu USN-8277-1, Kernel Patch).

The vulnerability was reported to the upstream kernel security team by Igor Ushakov, who provided a reproduction case. The upstream advisory was published via the linux-cve-announce mailing list by Greg Kroah-Hartman. Multiple downstream vendors (Ubuntu, Debian, Yocto Project) have issued security advisories and updated packages. No significant broader media coverage or notable researcher commentary beyond standard kernel security channels has been observed (Red Hat Bugzilla, Ubuntu USN-8277-1).