Loading vulnerability…
CVE-2026-53361 is a race condition in the Linux kernel's AF_UNIX garbage-collection logic. The flaw arises because unix_gc() could execute while the gc_in_progress state is false when garbage collection work is scheduled concurrently by multiple threads. In the described sequence, overlapping calls to unix_schedule_gc() can queue multiple garbage-collection work items, allowing a later unix_gc() invocation to run after an earlier one has already cleared the flag. This breaks the assumption relied upon by unix_peek_fpl(), which uses gc_in_progress to avoid confusing garbage collection during MSG_PEEK handling. The upstream fix sets gc_in_progress to true in unix_gc() itself so the flag correctly reflects active garbage-collection execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a full local Linux kernel privilege-escalation exploit for CVE-2026-53361, an AF_UNIX garbage-collector use-after-free reachable by an unprivileged user and described as container-escapable. It is not a framework module; it is a standalone C exploit with multiple support libraries and a Makefile that builds a static `exploit` binary. Repository structure: the codebase is split into focused components. `race.c/.h` implements the AF_UNIX socket graph, MSG_PEEK race, oracle logic, and timing calibration hooks. `lib_slubfw.c/.h` provides a reusable SLUB/skbuff grooming framework using loopback UDP sockets to shape allocator state and reclaim freed slab pages. `xattr.c/.h` manages tmpfs-backed `simple_xattr` sprays/resprays for kmalloc-cg-4k reclaim and leak phases. `lib_fault.c/.h` builds fault-controlled recvmsg/iovec mappings used to stall and synchronize the race. `dirtypt.c/.h` implements the post-UAF Dirty-Pagetable primitive: reclaiming a freed pipe-backed page as a leaf page table, then using partial pipe reads/writes to capture and forge PTEs for physical memory read/write. `pagemap*.c/.h` walk 4-level or 5-level page tables and bootstrap kernel address translation. `offset.c/.h` resolves kernel structure offsets from `/sys/kernel/btf/vmlinux` or fallback tables. `kallsysms.c/.h` parses in-kernel kallsyms from a physical dump to resolve symbols like `core_pattern`, `commit_creds`, and `avc_denied`. `shell.c/.h` contains the post-exploitation payload that plants a core_pattern handler and relays a root shell over AF_UNIX. `sstd.c/.h` is a stochastic optimizer used to search timing windows for the race. Main exploit capability: the exploit races AF_UNIX garbage collection against `MSG_PEEK` to free a still-referenced socket/sk_buff, then uses heap grooming and reclaim techniques to turn the UAF into controlled kernel object overlap. From there it constructs a fake pipe/file/sk_buff state, frees and reclaims a pipe page, and converts that into a page-table corruption primitive. With the resulting physical read/write, it self-maps the reclaimed leaf page table, discovers kernel base and symbols, overwrites `core_pattern`, and optionally disables SELinux by patching `avc_denied`. Finally it crashes a child process so the kernel executes the planted core handler as root in init namespaces, which connects back to a per-run UNIX socket and spawns `/bin/bash -i` or `/bin/sh -i`. Notable targeting details: README explicitly targets Linux 6.12-based kernels up to 6.12.94, Ubuntu 24.04 HWE 6.17 up to 6.17.0-41, RHEL 10 6.12-based kernels, and Debian trixie 6.12 builds. It states Ubuntu 24.04 GA 6.8 is vulnerable but not covered by this single-vector MSG_PEEK exploit. The exploit is intended for low CPU-count systems and relies on BTF availability by default. Overall, this is a real, advanced, operational local kernel exploit with a built-in root-shell payload, not merely a detector or proof-of-concept stub.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.