Loading story…
A high-severity Linux kernel use-after-free vulnerability, tracked as CVE-2026-53361 (CVSS 7.1), affects the AF_UNIX socket garbage collector and can allow an unprivileged local attacker to corrupt kernel memory and escape a container. The flaw is a race condition in which concurrent MSG_PEEK operations retain a reference to an in-flight file descriptor that the garbage collector fails to account for, potentially leaving a dangling sk_buff after a live socket is freed.
Technical details and public proof-of-concept exploit code, including work described as BAD_GARBAGE.c, have been released. No confirmed in-the-wild exploitation has been reported, but organizations running shared, multi-tenant, or containerized Linux environments should apply upstream or stable backport fixes—available in stable kernel version 6.12.95 and later—then reboot affected hosts; access by untrusted local users should be restricted until patching is complete.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Kernel maintainer Kuniyuki Iwashima authored an upstream fix that sets gc_in_progress inside unix_gc() to prevent the race condition. The fix was included in stable commit d82ba05263c6 and backports, including Linux stable kernel 6.12.95.
Researcher sgkdev published technical details and proof-of-concept exploit code for CVE-2026-53361, a high-severity Linux AF_UNIX garbage-collector use-after-free that can enable local kernel-memory corruption and container escape. No confirmed in-the-wild exploitation was reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Project Zero disclosed a Linux kernel vulnerability affecting **Linux `>= 6.9`** in which broken handling of **`AF_UNIX` `MSG_OOB`** traffic can trigger a **use-after-free (UAF)** condition, enabling both read and write access to freed memory. The issue was published in Project Zero's tracker as issue **`423023990`**, indicating a memory-safety flaw in the kernel's UNIX domain socket implementation rather than an application-level bug. The available references do not include a vendor advisory, patch details, CVE assignment, or exploitation evidence, but the bug title indicates potentially serious impact because kernel-level UAF read/write conditions can often be leveraged for privilege escalation or system compromise. Security teams running Linux kernels in the affected branch should monitor upstream kernel fixes and distribution backports, prioritize patch validation for systems that rely on local socket communication, and assess exposure in environments where untrusted local code execution is possible.
Jul 12, 2026
**CVE-2024-26923** is a race condition in the Linux kernel's AF_UNIX socket garbage collector that occurs when garbage collection runs concurrently with `connect()` on a partially initialized socket carrying `SCM_RIGHTS` file descriptors. The race can incorrectly increase an in-flight reference count, leave a dangling pointer in `gc_inflight_list`, and cause inaccurate active-socket accounting, allowing local resource exhaustion and denial of service. The affected code is `net/unix/garbage.c`, and the issue has existed since Linux kernel 2.6.23. Exploitation requires local low-privileged access and difficult-to-reproduce timing conditions, but Red Hat assigns a Moderate severity rating with CVSS 7.0. Fixed upstream kernels include 5.15.156, 6.1.87, 6.6.28, 6.8.7, and 6.9-rc4; Red Hat has issued corrected kernel packages for multiple RHEL 8 and RHEL 9 streams. Organizations should deploy current vendor kernel updates rather than cherry-picking patches; no separate mitigation is known.
Aug 26, 2026
A long-standing Linux kernel flaw in SCTP Dynamic Address Reconfiguration, tracked as **CVE-2026-64564** and dubbed **SCTPhantom**, was disclosed as a deterministic use-after-free bug that can let a low-privileged local user gain **root** privileges and potentially escape from a container to the host. The vulnerability affects ASCONF handling, where a crafted sequence of `DEL-IP` operations can free an SCTP transport and later reuse the dangling pointer. Researchers said the vulnerable logic dates back to **Linux 2.6.25** and reported successful exploitation on Debian 13, Ubuntu 24.04, Rocky Linux 9, RHEL 9-family systems, OpenCloudOS, and a Linux 7.2 release candidate, including multiple tested host-root container escapes. Fixes are available in mainline commit `9b2854f86f0b` and in stable kernel releases **6.6.148**, **6.12.101**, **6.18.42**, **7.1.6**, and **7.2-rc5**. Discussion on the oss-sec mailing list noted that practical exposure varies by distribution: on Rocky Linux 9 and RHEL 9-family systems, SCTP is typically not installed by default because it resides in the `kernel-modules-extra` package and is blacklisted for autoload, meaning administrators would generally need to explicitly install and load the module for the bug to be reachable. Defenders were urged to patch affected kernels or disable SCTP where it is not required.
Aug 12, 2026