Loading story…
Google Project Zero disclosed a Linux kernel vulnerability affecting Linux >= 6.9 in which broken handling of AF_UNIX MSG_OOB traffic can trigger a use-after-free (UAF) condition, enabling both read and write access to freed memory. The issue was published in Project Zero's tracker as issue 423023990, indicating a memory-safety flaw in the kernel's UNIX domain socket implementation rather than an application-level bug.
The available references do not include a vendor advisory, patch details, CVE assignment, or exploitation evidence, but the bug title indicates potentially serious impact because kernel-level UAF read/write conditions can often be leveraged for privilege escalation or system compromise. Security teams running Linux kernels in the affected branch should monitor upstream kernel fixes and distribution backports, prioritize patch validation for systems that rely on local socket communication, and assess exposure in environments where untrusted local code execution is possible.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
A Project Zero issue was published describing a Samsung QuramDng getOverlap miscalculation that leads to integer overflow and subsequent out-of-bounds read and write. The issue was published on 2025-11-04.
A Project Zero issue was published describing a Linux kernel vulnerability affecting Linux 6.9 and later, where broken AF_UNIX MSG_OOB handling causes a use-after-free enabling read and write. Duplicate references point to the same issue publication.
A Project Zero issue was published describing a V8 Turbofan bug where JSCallReducer::ReduceArrayIndexOfIncludes fails to insert Map checks. The issue was published on 2019-03-20.
A Project Zero issue was published describing a V8 Turbofan flaw in which optimizing Reflect.construct may read a Map pointer out of bounds. The issue was published on 2019-03-07.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
project-zero.issues.chromium.org
Open sourceproject-zero.issues.chromium.org
Open sourceproject-zero.issues.chromium.org
Open sourcebugs.chromium.org
Open sourcebugs.chromium.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A high-severity Linux kernel use-after-free vulnerability, tracked as **CVE-2026-53361** (CVSS 7.1), affects the AF_UNIX socket garbage collector and can allow an unprivileged local attacker to corrupt kernel memory and escape a container. The flaw is a race condition in which concurrent `MSG_PEEK` operations retain a reference to an in-flight file descriptor that the garbage collector fails to account for, potentially leaving a dangling `sk_buff` after a live socket is freed. Technical details and public proof-of-concept exploit code, including work described as `BAD_GARBAGE.c`, have been released. No confirmed in-the-wild exploitation has been reported, but organizations running shared, multi-tenant, or containerized Linux environments should apply upstream or stable backport fixes—available in stable kernel version 6.12.95 and later—then reboot affected hosts; access by untrusted local users should be restricted until patching is complete.
Aug 28, 2026
**CVE-2024-26923** is a race condition in the Linux kernel's AF_UNIX socket garbage collector that occurs when garbage collection runs concurrently with `connect()` on a partially initialized socket carrying `SCM_RIGHTS` file descriptors. The race can incorrectly increase an in-flight reference count, leave a dangling pointer in `gc_inflight_list`, and cause inaccurate active-socket accounting, allowing local resource exhaustion and denial of service. The affected code is `net/unix/garbage.c`, and the issue has existed since Linux kernel 2.6.23. Exploitation requires local low-privileged access and difficult-to-reproduce timing conditions, but Red Hat assigns a Moderate severity rating with CVSS 7.0. Fixed upstream kernels include 5.15.156, 6.1.87, 6.6.28, 6.8.7, and 6.9-rc4; Red Hat has issued corrected kernel packages for multiple RHEL 8 and RHEL 9 streams. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; no separate mitigation is known.
Aug 26, 2026
Two Linux kernel vulnerabilities, **CVE-2026-53362** and **CVE-2026-53366**, were disclosed in the UDP packet handling path and can allow a local unprivileged user to escalate privileges to root. The flaws affect the IPv6 UDPv6 path and the IPv4 UDP path when `MSG_SPLICE_PAGES` is used with UDP corking and a datagram crosses a fragment boundary, causing a heap out-of-bounds write. Researchers said incorrect `fraggap` accounting lets validation be bypassed, leading to corruption of `skb_shared_info` metadata and manipulation of the `nr_frags` field, which can ultimately produce a use-after-free condition exploitable for local privilege escalation. The bugs affect Linux kernels from **v6.1 onward**. The IPv6 issue requires `CONFIG_IPV6=y`, while the IPv4 variant also depends on access conditions tied to user namespaces. Fixes were published in upstream commits `736b380e28d0` for IPv6 and `eca856950f7c` for IPv4, and were released in stable kernel versions including **7.1.3, 6.18.38, 6.12.95, 6.6.144, and 6.1.177**. Advisories or updates were issued by major distributions including **Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, and Fedora**.
Jul 23, 2026