What’s Vulnerable › Vulnerabilities

CVE-2026-31673: af_unix: read UNIX_DIAG_VFS data under unix_state_lock

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-25 · updated 2026-10-19
• Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock. This keeps the VFS data stable while the reply is being built.

Affected products

• Linux kernel: from 3.3 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5, 7.0-rc6 (+1) — fixed in 6.12.83, 6.18.24, 6.19.14, 6.6.136

How to fix

Upgrade to a fixed version: Linux kernel 6.12.83, 6.18.24, 6.19.14, 6.6.136. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8
• https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef
• https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7
• https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9
• https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c
• https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0
• https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b
• https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442
• https://cert-portal.siemens.com/productcert/html/ssa-784472.html

Get alerted when CVE-2026-31673 or the next vulnerability affects your stack