Loading vulnerability…
CVE-2026-53361 is a race-induced use-after-free vulnerability in the Linux kernel's AF_UNIX garbage collector. Concurrent calls to unix_schedule_gc() can schedule another collection while unix_gc() is running. After the current execution clears gc_in_progress, the queued execution can run with that flag incorrectly set to false. The unix_peek_fpl() function relies on this flag to synchronize MSG_PEEK with garbage collection. A concurrent peek can consequently acquire a reference to an in-flight file descriptor that the collector does not account for, allowing a still-live socket to be freed and leaving a dangling sk_buff. Exploitation can corrupt kernel memory and is reported to permit container escape by an unprivileged local user.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a full local Linux kernel privilege-escalation exploit for CVE-2026-53361, an AF_UNIX garbage-collector use-after-free reachable by an unprivileged user and described as container-escapable. It is not a framework module; it is a standalone C exploit with multiple support libraries and a Makefile that builds a static `exploit` binary. Repository structure: the codebase is split into focused components. `race.c/.h` implements the AF_UNIX socket graph, MSG_PEEK race, oracle logic, and timing calibration hooks. `lib_slubfw.c/.h` provides a reusable SLUB/skbuff grooming framework using loopback UDP sockets to shape allocator state and reclaim freed slab pages. `xattr.c/.h` manages tmpfs-backed `simple_xattr` sprays/resprays for kmalloc-cg-4k reclaim and leak phases. `lib_fault.c/.h` builds fault-controlled recvmsg/iovec mappings used to stall and synchronize the race. `dirtypt.c/.h` implements the post-UAF Dirty-Pagetable primitive: reclaiming a freed pipe-backed page as a leaf page table, then using partial pipe reads/writes to capture and forge PTEs for physical memory read/write. `pagemap*.c/.h` walk 4-level or 5-level page tables and bootstrap kernel address translation. `offset.c/.h` resolves kernel structure offsets from `/sys/kernel/btf/vmlinux` or fallback tables. `kallsysms.c/.h` parses in-kernel kallsyms from a physical dump to resolve symbols like `core_pattern`, `commit_creds`, and `avc_denied`. `shell.c/.h` contains the post-exploitation payload that plants a core_pattern handler and relays a root shell over AF_UNIX. `sstd.c/.h` is a stochastic optimizer used to search timing windows for the race. Main exploit capability: the exploit races AF_UNIX garbage collection against `MSG_PEEK` to free a still-referenced socket/sk_buff, then uses heap grooming and reclaim techniques to turn the UAF into controlled kernel object overlap. From there it constructs a fake pipe/file/sk_buff state, frees and reclaims a pipe page, and converts that into a page-table corruption primitive. With the resulting physical read/write, it self-maps the reclaimed leaf page table, discovers kernel base and symbols, overwrites `core_pattern`, and optionally disables SELinux by patching `avc_denied`. Finally it crashes a child process so the kernel executes the planted core handler as root in init namespaces, which connects back to a per-run UNIX socket and spawns `/bin/bash -i` or `/bin/sh -i`. Notable targeting details: README explicitly targets Linux 6.12-based kernels up to 6.12.94, Ubuntu 24.04 HWE 6.17 up to 6.17.0-41, RHEL 10 6.12-based kernels, and Debian trixie 6.12 builds. It states Ubuntu 24.04 GA 6.8 is vulnerable but not covered by this single-vector MSG_PEEK exploit. The exploit is intended for low CPU-count systems and relies on BTF availability by default. Overall, this is a real, advanced, operational local kernel exploit with a built-in root-shell payload, not merely a detector or proof-of-concept stub.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A race condition in Linux kernel AF_UNIX garbage collection can allow unix_gc() to run while gc_in_progress is false, undermining the coordination relied upon by unix_peek_fpl() during MSG_PEEK operations. The fix sets gc_in_progress to true within unix_gc(). The advisory assigns a CVSS v3 base score of 7.1, indicating local exploitation requiring low privileges, with potential high integrity and availability impacts. Affected Google COS kernel packages should be updated to version 18613.675.2 or later.
A vulnerability addressed by Ubuntu Security Notice USN-8801-1; the provided content does not specify its vulnerability type or impact.
A Linux kernel vulnerability addressed by the referenced AlmaLinux 10 kernel-package advisory; no technical flaw details are provided.
A vulnerability addressed by the Oracle Linux ELSA-2026-674710 kernel package update; no technical flaw details are provided.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.