In the Linux kernel, the following vulnerability has been resolved:
af_unix: Clear stale u->oob_skb.
syzkaller started to report deadlock of unix_gc_lock after commit 4090fa373f0e ("af_unix: Replace garbage collection algorithm."), but it just uncovers the bug that has been there since commit 314001f0bf92 ("af_unix: Add OOB support").
The repro basically does the following.
from socket import * from array import array
c1, c2 = socketpair(AF_UNIX, SOCK_STREAM) c1.sendmsg([b'a'], [(SOL_SOCKET, SCM_RIGHTS, array("i", [c2.fileno()]))], MSG_OOB) c2.recv(1) # blocked as no normal data in recv queue
c2.close() # done async and unblock recv() c1.close() # done async and trigger GC
A socket sends its file descriptor to itself as OOB data and tries to receive normal data, but finally recv() fails due to async close().
The problem here is wrong handling of OOB skb in manage_oob(). When recvmsg() is called without MSG_OOB, manage_oob() is called to check if the peeked skb is OOB skb. In such a case, manage_oob() pops it out of the receive queue but does not clear unix_sock(sk)->oob_skb. This is wrong in terms of uAPI.
Let's say we send "hello" with MSG_OOB, and "world" without MSG_OOB. The 'o' is handled as OOB data. When recv() is called twice without MSG_OOB, the OOB data should be lost.
>>> from socket import * >>> c1, c2 = socketpair(AF_UNIX, SOCK_STREAM, 0) >>> c1.send(b'hello', MSG_OOB) # 'o' is OOB data 5 >>> c1.send(b'world') 5 >>> c2.recv(5) # OOB data is not received b'hell' >>> c2.recv(5) # OOB date is skipped b'world' >>> c2.recv(5, MSG_OOB) # This should return an error b'o'
In the same situation, TCP actually returns -EINVAL for the last recv().
Also, if we do not clear unix_sk(sk)->oob_skb, unix_poll() always set EPOLLPRI even though the data has passed through by previous recv().
To avoid these issues, we must clear unix_sk(sk)->oob_skb when dequeuing it from recv queue.
The reason why the old GC did not trigger the deadlock is because the old GC relied on the receive queue to detect the loop.
When it is triggered, the socket with OOB data is marked as GC candidate because file refcount == inflight count (1). However, after traversing all inflight sockets, the socket still has a positive inflight count (1), thus the socket is excluded from candidates. Then, the old GC lose the chance to garbage-collect the socket.
With the old GC, the repro continues to create true garbage that will never be freed nor detected by kmemleak as it's linked to the global inflight list. That's why we couldn't even notice the issue.
CVSS Details
- CVSS 3.1 Base Score: 6.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade perf-debuginfoUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade perfUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernel-livepatch-5.15.156-102.160Upgrade kernel-debuginfo-common-aarch64Upgrade bpftoolUpgrade kernel-develUpgrade kernel-toolsUpgrade kernelUpgrade python-perf | May 22, 2025 | May 20, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-develUpgrade kernel-headersUpgrade kernelUpgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-6.1.87-99.174Upgrade bpftool-debuginfoUpgrade bpftoolUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-toolsUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-modules-extra-commonUpgrade python3-perfUpgrade perf-debuginfo | Jun 11, 2025 | May 20, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | May 20, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 20, 2024 |
| Suse | — | Upgrade kernel-default-extraUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-kvmsmallUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-vdsoUpgrade dtb-marvellUpgrade kernel-azure-livepatch-develUpgrade kernel-sourceUpgrade dtb-exynosUpgrade dtb-mediatekUpgrade kernel-64kbUpgrade kernel-symsUpgrade dtb-amazonUpgrade kernel-syms-rtUpgrade gfs2-kmp-rtUpgrade kernel-docsUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-vdsoUpgrade kernel-syms-azureUpgrade reiserfs-kmp-azureUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-azureUpgrade kernel-rtUpgrade kernel-zfcpdumpUpgrade kernel-64kb-optionalUpgrade kernel-azure-develUpgrade kernel-rt_debugUpgrade kernel-azure-extraUpgrade dtb-apmUpgrade cluster-md-kmp-azureUpgrade reiserfs-kmp-rtUpgrade dtb-appleUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-kvmsmall-develUpgrade kernel-rt-livepatch-develUpgrade kernel-source-azureUpgrade dtb-amlogicUpgrade kernel-obs-qaUpgrade dtb-armUpgrade dtb-qcomUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-default-develUpgrade kernel-macrosUpgrade kselftests-kmp-defaultUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-azureUpgrade kernel-rt-optionalUpgrade dtb-amdUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade dtb-rockchipUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-default-optionalUpgrade kernel-default-livepatch-develUpgrade dtb-sprdUpgrade gfs2-kmp-defaultUpgrade kselftests-kmp-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-develUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade dtb-xilinxUpgrade dtb-renesasUpgrade dtb-nvidiaUpgrade dtb-broadcomUpgrade dlm-kmp-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-livepatchUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade dtb-hisiliconUpgrade cluster-md-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-source-rtUpgrade dtb-alteraUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade kernel-default-baseUpgrade kernel-64kb-extraUpgrade kernel-rt-develUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-defaultUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade kernel-obs-buildUpgrade dtb-caviumUpgrade dtb-freescaleUpgrade dtb-lgUpgrade kernel-default-vdso | Jul 23, 2024 | May 20, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1062-kvmUpgrade linux-image-5.15.0-1064-gcpUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-gke-5.15Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-6.8.0-38-genericUpgrade linux-image-genericUpgrade linux-image-lowlatency-64kUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-generic-64kUpgrade linux-image-oracle-64kUpgrade linux-image-5.15.0-1060-intel-iotgUpgrade linux-image-intelUpgrade linux-image-5.15.0-1060-nvidiaUpgrade linux-image-azureUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-oem-20.04bUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-5.15.0-1068-azure-fdeUpgrade linux-image-oem-20.04dUpgrade linux-image-gkeop-5.15Upgrade linux-image-ibmUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-116-lowlatency-64kUpgrade linux-image-5.15.0-1065-awsUpgrade linux-image-5.15.0-1058-raspiUpgrade linux-image-lowlatencyUpgrade linux-image-intel-iotgUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-oem-20.04cUpgrade linux-image-azure-fdeUpgrade linux-image-raspiUpgrade linux-image-azure-lts-22.04Upgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-gcpUpgrade linux-image-nvidiaUpgrade linux-image-nvidia-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-5.15.0-116-generic-lpaeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-24.04Upgrade linux-image-5.15.0-116-lowlatencyUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1068-azureUpgrade linux-image-raspi-nolpaeUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1011-awsUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-6.8.0-1010-azureUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-5.15.0-116-generic-64kUpgrade linux-image-5.15.0-116-genericUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-5.15.0-1065-gcpUpgrade linux-image-5.15.0-1060-nvidia-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-5.15.0-1058-ibmUpgrade linux-image-virtualUpgrade linux-image-5.15.0-1063-oracleUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-5.15.0-1035-xilinx-zynqmpUpgrade linux-image-5.15.0-1062-gkeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-6.8.0-1007-intelUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-aws-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-5.15.0-1048-gkeopUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-awsUpgrade linux-image-oracleUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-gkeUpgrade linux-image-generic-lpae-hwe-20.04 | Jul 12, 2024 | May 20, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | May 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub