In the Linux kernel, the following vulnerability has been resolved:
af_unix: Fix data-race around unix_tot_inflight.
unix_tot_inflight is changed under spin_lock(unix_gc_lock), but unix_release_sock() reads it locklessly.
Let's use READ_ONCE() for unix_tot_inflight.
Note that the writer side was marked by commit 9d6d7f1cb67c ("af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress")
BUG: KCSAN: data-race in unix_inflight / unix_release_sock
write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1: unix_inflight+0x130/0x180 net/unix/scm.c:64 unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123 unix_scm_to_skb net/unix/af_unix.c:1832 [inline] unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x148/0x160 net/socket.c:747 ____sys_sendmsg+0x4e4/0x610 net/socket.c:2493 ___sys_sendmsg+0xc6/0x140 net/socket.c:2547 __sys_sendmsg+0x94/0x140 net/socket.c:2576 __do_sys_sendmsg net/socket.c:2585 [inline] __se_sys_sendmsg net/socket.c:2583 [inline] __x64_sys_sendmsg+0x45/0x50 net/socket.c:2583 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffffffff871852b8 of 4 bytes by task 4891 on cpu 0: unix_release_sock+0x608/0x910 net/unix/af_unix.c:671 unix_release+0x59/0x80 net/unix/af_unix.c:1058 __sock_release+0x7d/0x170 net/socket.c:653 sock_close+0x19/0x30 net/socket.c:1385 __fput+0x179/0x5e0 fs/file_table.c:321 ____fput+0x15/0x20 fs/file_table.c:349 task_work_run+0x116/0x1a0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297 do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0x00000000 -> 0x00000001
Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 4891 Comm: systemd-coredum Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade bpftoolUpgrade kernelUpgrade kernel-livepatch-5.15.133-86.144Upgrade kernel-headersUpgrade perfUpgrade perf-debuginfoUpgrade kernel-livepatch-4.14.326-245.539Upgrade python-perfUpgrade kernel-toolsUpgrade kernel-livepatch-5.10.196-185.743Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-tools-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade perfUpgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-livepatch-6.1.55-75.123Upgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-libbpf-staticUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-tools-devel | Feb 20, 2026 | Dec 24, 2025 |
| Debian | — | Upgrade linux | Dec 29, 2025 | Dec 29, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 24, 2025 |
| Ubuntu | — | Upgrade linux-nvidia-tegra-5.15Upgrade linux-azure-5.4Upgrade linux-intel-iotgUpgrade linux-intel-iot-realtimeUpgrade linux-azure-fdeUpgrade linux-awsUpgrade linux-intel-iotg-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-riscv-5.15Upgrade linux-ibm-5.15Upgrade linux-fipsUpgrade linux-bluefieldUpgrade linux-realtimeUpgrade linux-kvmUpgrade linux-gcpUpgrade linux-gcp-5.15Upgrade linux-raspi-5.4Upgrade linux-aws-5.15Upgrade linux-gcp-fipsUpgrade linux-aws-5.4Upgrade linux-nvidia-tegra-igxUpgrade linux-lowlatencyUpgrade linux-nvidia-tegraUpgrade linux-aws-fipsUpgrade linux-azure-fipsUpgrade linuxUpgrade linux-gkeopUpgrade linux-hwe-5.15Upgrade linux-iotUpgrade linux-gcp-5.4Upgrade linux-ibmUpgrade linux-oracleUpgrade linux-nvidiaUpgrade linux-ibm-5.4Upgrade linux-xilinx-zynqmpUpgrade linux-azure-5.15Upgrade linux-gkeUpgrade linux-hwe-5.4Upgrade linux-raspiUpgrade linux-azureUpgrade linux-oracle-5.15Upgrade linux-oracle-5.4 | Jan 6, 2026 | Dec 24, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 24, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub