SB2026100774 - Improper resource shutdown or release in Linux kernel unix

Description

This security bulletin contains information about 1 vulnerability.

1) Improper resource shutdown or release (CVE-ID: CVE-2026-98289)

CWE-ID: CWE-404 - Improper Resource Shutdown or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to prevent garbage collection of UNIX socket resources.

The vulnerability exists due to inconsistent strongly connected component indices in the AF_UNIX garbage collector's __unix_walk_scc() function when finalising strongly connected components. A local user can trigger depth-first traversal of a UNIX socket graph containing multiple back edges to prevent garbage collection of UNIX socket resources.

The failure depends on the traversal order: vertices within the same strongly connected component can retain different lowpoint values, causing unix_vertex_dead() to incorrectly treat an edge as leading to another component.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd
• https://git.kernel.org/stable/c/b8f71d69380a5fbc734c868acbeb560f1de1766f
• https://git.kernel.org/stable/c/be550ee108ad80828aa61280400bedfc7e7c39d3