In the Linux kernel, the following vulnerability has been resolved:
af_unix: Don't leave consecutive consumed OOB skbs.
Jann Horn reported a use-after-free in unix_stream_read_generic().
The following sequences reproduce the issue:
$ python3 from socket import * s1, s2 = socketpair(AF_UNIX, SOCK_STREAM) s1.send(b'x', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'y', MSG_OOB) s2.recv(1, MSG_OOB) # leave a consumed OOB skb s1.send(b'z', MSG_OOB) s2.recv(1) # recv 'z' illegally s2.recv(1, MSG_OOB) # access 'z' skb (use-after-free)
Even though a user reads OOB data, the skb holding the data stays on the recv queue to mark the OOB boundary and break the next recv().
After the last send() in the scenario above, the sk2's recv queue has 2 leading consumed OOB skbs and 1 real OOB skb.
Then, the following happens during the next recv() without MSG_OOB
1. unix_stream_read_generic() peeks the first consumed OOB skb 2. manage_oob() returns the next consumed OOB skb 3. unix_stream_read_generic() fetches the next not-yet-consumed OOB skb 4. unix_stream_read_generic() reads and frees the OOB skb
, and the last recv(MSG_OOB) triggers KASAN splat.
The 3. above occurs because of the SO_PEEK_OFF code, which does not expect unix_skb_len(skb) to be 0, but this is true for such consumed OOB skbs.
while (skip >= unix_skb_len(skb)) { skip -= unix_skb_len(skb); skb = skb_peek_next(skb, &sk->sk_receive_queue); ... }
In addition to this use-after-free, there is another issue that ioctl(SIOCATMARK) does not function properly with consecutive consumed OOB skbs.
So, nothing good comes out of such a situation.
Instead of complicating manage_oob(), ioctl() handling, and the next ECONNRESET fix by introducing a loop for consecutive consumed OOB skbs, let's not leave such consecutive OOB unnecessarily.
Now, while receiving an OOB skb in unix_stream_recv_urg(), if its previous skb is a consumed OOB skb, it is freed.
[0]: BUG: KASAN: slab-use-after-free in unix_stream_read_actor (net/unix/af_unix.c:3027) Read of size 4 at addr ffff888106ef2904 by task python3/315
CPU: 2 UID: 0 PID: 315 Comm: python3 Not tainted 6.16.0-rc1-00407-gec315832f6f9 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:122) print_report (mm/kasan/report.c:409 mm/kasan/report.c:521) kasan_report (mm/kasan/report.c:636) unix_stream_read_actor (net/unix/af_unix.c:3027) unix_stream_read_generic (net/unix/af_unix.c:2708 net/unix/af_unix.c:2847) unix_stream_recvmsg (net/unix/af_unix.c:3048) sock_recvmsg (net/socket.c:1063 (discriminator 20) net/socket.c:1085 (discriminator 20)) __sys_recvfrom (net/socket.c:2278) __x64_sys_recvfrom (net/socket.c:2291 (discriminator 1) net/socket.c:2287 (discriminator 1) net/socket.c:2287 (discriminator 1)) do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) RIP: 0033:0x7f8911fcea06 Code: 5d e8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 75 19 83 e2 39 83 fa 08 75 11 e8 26 ff ff ff 66 0f 1f 44 00 00 48 8b 45 10 0f 05 <48> 8b 5d f8 c9 c3 0f 1f 40 00 f3 0f 1e fa 55 48 89 e5 48 83 ec 08 RSP: 002b:00007fffdb0dccb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002d RAX: ffffffffffffffda RBX: 00007fffdb0dcdc8 RCX: 00007f8911fcea06 RDX: 0000000000000001 RSI: 00007f8911a5e060 RDI: 0000000000000006 RBP: 00007fffdb0dccd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000202 R12: 00007f89119a7d20 R13: ffffffffc4653600 R14: 0000000000000000 R15: 0000000000000000 </TASK>
Allocated by task 315: kasan_save_stack (mm/kasan/common.c:48) kasan_save_track (mm/kasan/common.c:60 (discriminator 1) mm/kasan/common.c:69 (discriminator 1)) __kasan_slab_alloc (mm/kasan/common.c:348) kmem_cache_alloc_ ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-livepatch-5.15.189-131.211Upgrade perfUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade kernelUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel6.12-libbpfUpgrade kernel-modules-extra-commonUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-livepatch-6.12.37-61.105Upgrade kernel6.12-toolsUpgrade kernel6.12-libbpf-develUpgrade kernel6.12-tools-debuginfoUpgrade bpftool6.12Upgrade kernel6.12-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel6.12-libbpf-staticUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade perf6.12-debuginfoUpgrade kernelUpgrade kernel-livepatch-6.1.144-170.251Upgrade perfUpgrade python3-perf6.12-debuginfoUpgrade bpftoolUpgrade python3-perfUpgrade bpftool-debuginfoUpgrade kernel6.12Upgrade python3-perf6.12Upgrade kernel6.12-headersUpgrade bpftool6.12-debuginfoUpgrade kernel-develUpgrade kernel6.12-develUpgrade kernel6.12-tools-develUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel-debuginfo-common-x86_64Upgrade kernel6.12-libbpf-debuginfoUpgrade kernel-libbpfUpgrade perf6.12Upgrade kernel6.12-modules-extraUpgrade kernel6.12-debuginfo-common-aarch64Upgrade kernel-modules-extraUpgrade kernel-tools-debuginfoUpgrade python3-perf-debuginfoUpgrade kernel-libbpf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel6.12-modules-extra-common | Aug 5, 2025 | Jul 8, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 10, 2025 | Jul 8, 2025 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 16, 2025 | Jul 8, 2025 |
| Redhat_linux | — | — | Jul 14, 2025 | Jul 8, 2025 |
| Suse | — | Upgrade kselftests-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade cluster-md-kmp-defaultUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade kernel-obs-qaUpgrade dtb-nvidiaUpgrade kernel-64kb-develUpgrade kernel-syms-azureUpgrade kernel-default-extraUpgrade dtb-rockchipUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade dtb-sprdUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade kernel-defaultUpgrade dlm-kmp-rtUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade kernel-debugUpgrade kernel-devel-rtUpgrade ocfs2-kmp-rtUpgrade cluster-md-kmp-64kbUpgrade dtb-apmUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade kselftests-kmp-rtUpgrade kernel-kvmsmallUpgrade reiserfs-kmp-azureUpgrade kernel-macrosUpgrade dlm-kmp-azureUpgrade cluster-md-kmp-rtUpgrade dtb-armUpgrade kernel-docsUpgrade dtb-mediatekUpgrade dtb-amazonUpgrade kernel-kvmsmall-vdsoUpgrade dtb-marvellUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-azureUpgrade dtb-appleUpgrade kselftests-kmp-64kbUpgrade dtb-freescaleUpgrade reiserfs-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-default-develUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade kernel-source-rtUpgrade kernel-azure-extraUpgrade dlm-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-buildUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-rt-extraUpgrade dtb-hisiliconUpgrade kselftests-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-source-vanillaUpgrade kernel-devel-azureUpgrade kernel-debug-develUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-source-azureUpgrade kernel-default-baseUpgrade dtb-caviumUpgrade dlm-kmp-defaultUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-azure-develUpgrade dtb-exynosUpgrade dtb-amlogicUpgrade ocfs2-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade dtb-renesasUpgrade dtb-lgUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-default-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-64kb-optionalUpgrade dtb-broadcomUpgrade dtb-alteraUpgrade kernel-rt_debug | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade linux-image-gcp-64k-6.14Upgrade linux-image-generic-6.14Upgrade linux-image-6.14.0-1015-aws-64kUpgrade linux-image-azure-fipsUpgrade linux-image-gke-64kUpgrade linux-image-lowlatencyUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-raspi-nolpaeUpgrade linux-image-lowlatency-6.8Upgrade linux-image-5.15.0-1064-xilinx-zynqmpUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-oem-20.04bUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-5.15.0-1092-kvmUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-generic-64k-5.15Upgrade linux-image-5.15.0-1100-gcpUpgrade linux-image-6.14.0-1014-oemUpgrade linux-image-kvmUpgrade linux-image-5.15.0-170-genericUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-generic-64k-6.8Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-azure-fips-6.8Upgrade linux-image-5.15.0-1052-nvidia-tegra-rtUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspi-6.8Upgrade linux-image-5.15.0-1100-aws-64kUpgrade linux-image-5.15.0-170-generic-64kUpgrade linux-image-xilinxUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-oem-24.04cUpgrade linux-image-ibm-classicUpgrade linux-image-5.15.0-1041-nvidia-tegra-igx-rtUpgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-5.15.0-170-generic-lpaeUpgrade linux-image-aws-fips-5.15Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-6.14.0-1015-awsUpgrade linux-image-aws-lts-22.04Upgrade linux-image-realtime-hwe-24.04Upgrade linux-image-gke-5.15Upgrade linux-image-raspi-6.14Upgrade linux-image-5.15.0-1095-nvidiaUpgrade linux-image-5.15.0-1052-nvidia-tegraUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-aws-64k-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-gkeop-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-170-fipsUpgrade linux-image-5.15.0-1110-azureUpgrade linux-image-virtual-6.14Upgrade linux-image-6.14.0-1018-gcpUpgrade linux-image-azure-nvidia-6.14Upgrade linux-image-fips-6.8Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-64k-6.14Upgrade linux-image-6.14.0-1015-oracle-64kUpgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-gcp-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-azure-nvidiaUpgrade linux-image-awsUpgrade linux-image-5.15.0-1097-raspiUpgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-oracle-5.15Upgrade linux-image-virtual-6.8Upgrade linux-image-aws-6.8Upgrade linux-image-gcp-5.15Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-6.14Upgrade linux-image-aws-64k-5.15Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-oracle-64k-6.14Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-6.8.0-1046-awsUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-generic-6.8Upgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1092-intel-iot-realtimeUpgrade linux-image-5.15.0-170-lowlatency-64kUpgrade linux-image-ibmUpgrade linux-image-gcp-fips-5.15Upgrade linux-image-generic-5.15Upgrade linux-image-gcp-fipsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-azureUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-oracle-6.14Upgrade linux-image-raspiUpgrade linux-image-5.15.0-1100-gcp-fipsUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1109-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-5.15.0-1096-gkeUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-5.15.0-1099-realtimeUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-oem-24.04bUpgrade linux-image-lowlatency-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-oem-20.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-azure-6.8Upgrade linux-image-aws-64kUpgrade linux-image-aws-6.14Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1095-nvidia-lowlatencyUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.14.0-1016-raspiUpgrade linux-image-intelUpgrade linux-image-oem-20.04cUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-oracleUpgrade linux-image-realtime-5.15Upgrade linux-image-oracle-64kUpgrade linux-image-realtime-6.14Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-oem-6.14Upgrade linux-image-nvidia-64kUpgrade linux-image-lowlatency-5.15Upgrade linux-image-generic-64k-6.14Upgrade linux-image-generic-64kUpgrade linux-image-fipsUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-gkeUpgrade linux-image-5.15.0-1109-azure-fipsUpgrade linux-image-5.15.0-1094-ibmUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-oem-22.04dUpgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-aws-5.15Upgrade linux-image-5.15.0-1097-oracleUpgrade linux-image-realtimeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-azure-6.14Upgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-raspi-realtimeUpgrade linux-image-generic-lpae-5.15Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-fips-5.15Upgrade linux-image-azure-5.15Upgrade linux-image-6.8.0-100-fipsUpgrade linux-image-6.14.0-1014-realtimeUpgrade linux-image-5.15.0-170-lowlatencyUpgrade linux-image-5.15.0-1100-awsUpgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-gkeopUpgrade linux-image-aws-fipsUpgrade linux-image-gcp-6.8Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-6.14.0-34-generic-64kUpgrade linux-image-6.14.0-1015-oracleUpgrade linux-image-5.15.0-1095-intel-iotgUpgrade linux-image-5.15.0-1083-gkeopUpgrade linux-image-raspi-5.15Upgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-virtualUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-kvm-5.15Upgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1041-nvidia-tegra-igxUpgrade linux-image-oracle-6.8Upgrade linux-image-nvidia-5.15Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.14.0-34-genericUpgrade linux-image-6.14.0-1007-azure-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-virtual-5.15Upgrade linux-image-gcpUpgrade linux-image-fips-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-nvidia-tegraUpgrade linux-image-nvidia-6.8Upgrade linux-image-oem-24.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-oem-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-6.14.0-1018-gcp-64kUpgrade linux-image-6.14.0-1014-azureUpgrade linux-image-5.15.0-1100-aws-fips | Jul 9, 2025 | Jul 8, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 16, 2025 | Jul 8, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub