All vulnerabilities
CVE-2026-98394

Linux: af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3d3c7a3df66b2ca3d2cd1a2a0c37eb701feba713Also 6e5ee08eb5858d175da6768d75d163817b6a9d4aCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 3d3c7a3df66b2ca3d2cd1a2a0c37eb701feba713LinuxCVE List
  • 6e5ee08eb5858d175da6768d75d163817b6a9d4aLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

Fahad Alharbi reported that recv(0, MSG_PEEK) triggers busy-wait in unix_stream_read_generic() if recv() is blocking and the last skb in the queue is MSG_OOB skb.

In such a situation, TCP returns 0 immediately regardless of blocking or non-blocking.

Let's follow the behaviour.

Text from CVE List

Affected versions 10

  • Linuxaffected: 314001f0bf927015e459c9d387d62a231fe93af3 before 3d3c7a3df66b2ca3d2cd1a2a0c37eb701feba713CVE List
  • Linuxaffected: 314001f0bf927015e459c9d387d62a231fe93af3 before d5dd55b316ca229a4cbf11729483ba5bb57233e7CVE List
  • Linuxaffected: 314001f0bf927015e459c9d387d62a231fe93af3 before c81c5be3826c8467945b964d0cf7f7b3d65461dbCVE List
  • Linuxaffected: 314001f0bf927015e459c9d387d62a231fe93af3 before 6e5ee08eb5858d175da6768d75d163817b6a9d4aCVE List
  • Linuxaffected: 5.15CVE List
  • Linuxunaffected: all versions before 5.15CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 4