All vulnerabilities
CVE-2026-97985

Linux: af_unix: Update last skb marker in manage_oob().

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 5% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in0630bfc773d85ac44da05b2c5a037dbbd39301abAlso 94fd4debd2e3a69cf93e766c8b328a810c228119, 6.6.160 and 3 moreCVE List
Published25 Sep 2026Updated 21 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Update last skb marker in manage_oob().

Fahad Alharbi reported that blocking recv(MSG_PEEK) could hog CPU due to OOB skb.

In the following cases, manage_oob() skips OOB skb(s) and returns NULL for the last recv(MSG_PEEK):

socketpair(AF_UNIX, SOCK_STREAM, 0, sk);

1) skb -> OOB skb -> NULL send(sk[0], "ab", 2, MSG_OOB); recv(sk[1], buf, 0, MSG_PEEK);

2) skb -> consumed OOB skb -> NULL send(sk[0], "ab", 2, MSG_OOB); recv(sk[1], buf, 1, MSG_OOB); recv(sk[1], buf, 0, MSG_PEEK);

3) consumed OOB skb -> OOB skb -> NULL send(sk[0], "a", 1, MSG_OOB); recv(sk[1], buf, 0, MSG_OOB); send(sk[0], "b", 1, MSG_OOB); recv(sk[1], buf, 1, MSG_PEEK);

Then, @copied is 0 in unix_stream_read_generic() (zero-length buffer, or non-OOB skb is not yet consumed), and unix_stream_data_wait() is called.

However, it returns immediately because @last is not updated in unix_stream_read_generic(), and the thread busy-waits for a new skb.

Let's update @last in manage_oob().

For MSG_PEEK, @last is updated with the skipped OOB, and for the non-peek case, @last matches the returned value (when !copied) because OOB is unlinked.

Note that manage_oob() is inlined and no stack canary is added.

Text from CVE List

Affected versions 19

  • Linuxaffected: 022d81a709cd553bbe2db8675f8e824f4aee6284 before bd91dc313afe21e9d6b31ca6a47606a33ca5e35cCVE List
  • Linuxaffected: 22dd70eb2c3d754862964377a75abafd3167346b before 0630bfc773d85ac44da05b2c5a037dbbd39301abCVE List
  • Linuxaffected: 22dd70eb2c3d754862964377a75abafd3167346b before f1816b3d7ce80dcf086bb68ff5ae6e09520ca1faCVE List
  • Linuxaffected: 22dd70eb2c3d754862964377a75abafd3167346b before fc62a26493a98a0424d9dae2eb92a1daa1321f65CVE List
  • Linuxaffected: 22dd70eb2c3d754862964377a75abafd3167346b before 94fd4debd2e3a69cf93e766c8b328a810c228119CVE List
  • Linuxaffected: ae3f9e1221b31b18dbd4c4b85d08574996bbd973CVE List
  • Linuxaffected: ba0db4638525b8b054b3d546b45f7e473f477027CVE List
  • Linuxaffected: 16dc252e7007547a7b72a2c21022ef81fb45e6a3CVE List
  • Linuxaffected: 6.6.29 before 6.6.160CVE List
  • Linuxaffected: 5.15.157 before 5.16CVE List
  • Linuxaffected: 6.1.88 before 6.2CVE List
  • Linuxaffected: 6.8.8 before 6.9CVE List
  • Linuxaffected: 6.9CVE List
  • Linuxunaffected: all versions before 6.9CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5