In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The follo…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: af_unix: Don't leave consecutive consumed OOB skbs. Jann Horn reported a use-after-free in unix_stream_read_generic(). The following sequences reproduce the issue: $ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'y', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'z', MSG_OOB) s…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/32ca245464e1479bfea8592b9db227fdc1641705 Patch
- https://git.kernel.org/stable/c/523edfed4f68b7794d85b9ac828c5f8f4442e4c5 Patch
- https://git.kernel.org/stable/c/61a9ad7b69ce688697e5f63332f03e17725353bc Patch
- https://git.kernel.org/stable/c/8db4d2d026e6e3649832bfe23b96c4acff0756db Patch
- https://git.kernel.org/stable/c/a12237865b48a73183df252029ff5065d73d305e Patch
- https://git.kernel.org/stable/c/fad0a2c16062ac7c606b93166a7ce9d265bab976 Patch
- https://project-zero.issues.chromium.org/issues/423023990 Issue Tracking
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Mailing List
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Timeline
- nvd_ingest NVD