CVE-2026-53361: CVE-2026-53361: In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_pr…
linux · linux kernel · NVD published 2026-07-04 · posted 2026-08-10 · last modified 2026-10-20
What it is
In the Linux kernel, the following vulnerability has been resolved: af_unix: Set gc_in_progress to true in unix_gc(). Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc().
| Weakness | CWE-362 |
|---|---|
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) |
| ATT&CK tactics | n/a |
Exploitation evidence
First exploit evidence seen: 2026-08-10 (earliest date across the sources below).
Exploited in the wild
No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).
Public exploit code
GitHub proof-of-concept repositories
1 public repositories from 1 accounts, first seen 2026-08-10. Most starred: sgkdev/bad_garbage (26 stars), view repository.
Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.
Sources: nomi-sec/PoC-in-GitHub.
How to fix it
Fixed versions
- linux linux kernel: upgrade to 6.2 or later (affected from 6.1.141)
- linux linux kernel: upgrade to 6.6.144 or later (affected from 6.6.93)
- linux linux kernel: upgrade to 6.12.95 or later (affected from 6.9)
- linux linux kernel: upgrade to 6.18.38 or later (affected from 6.13)
- linux linux kernel: upgrade to 7.1 or later (affected from 6.19)
Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.
Vendor advisories and patches
- https://git.kernel.org/stable/c/0cfa78c050662784fc8e3ab26dbfd1dc632b2082 (Patch)
- https://git.kernel.org/stable/c/591f1ac217428a6d2b32a8ac14aac0fab44f155a (Patch)
- https://git.kernel.org/stable/c/82c17e13d404f686e164590483fd6c1abaa675d0 (Patch)
- https://git.kernel.org/stable/c/d82ba05263c69fa2437fe93e4e561cc40f4c03af (Patch)
Detection Generic guidance
Response checklist Generic guidance
- Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
- Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
- Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
- Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.