CVE-2026-45887: af_unix: Fix memleak of newsk in unix_stream_connect().

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-27 · updated 2026-06-25
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix memleak of newsk in unix_stream_connect(). When prepare_peercred() fails in unix_stream_connect(), unix_release_sock() is not called for newsk, and the memory is leaked. Let's move prepare_peercred() before unix_create1().

Affected products

Linux kernel: from 6.16 before 6.18.14; from 6.19 before 6.19.4 — fixed in 6.18.14, 6.19.4

How to fix

Upgrade to a fixed version: Linux kernel 6.18.14, 6.19.4. Check the vendor advisory for mitigations.

References

https://git.kernel.org/stable/c/365996a2b14d07caa9e33d367b67ea26c09d89b4
https://git.kernel.org/stable/c/6884028cd7f275f8bcb854a347265cb1fb0e4bea
https://git.kernel.org/stable/c/a5d95d7caba0160fb7b2b8d2bd96d5a1be861d9f

Get alerted when CVE-2026-45887 or the next vulnerability affects your stack