Improper resource shutdown or release in Linux kernel - CVE-2026-98289

Vulnerability details

The vulnerability allows a local user to prevent garbage collection of UNIX socket resources.

The vulnerability exists due to inconsistent strongly connected component indices in the AF_UNIX garbage collector's __unix_walk_scc() function when finalising strongly connected components. A local user can trigger depth-first traversal of a UNIX socket graph containing multiple back edges to prevent garbage collection of UNIX socket resources.

The failure depends on the traversal order: vertices within the same strongly connected component can retain different lowpoint values, causing unix_vertex_dead() to incorrectly treat an edge as leading to another component.

Affected software

How to mitigate CVE-2026-98289

External References

• https://git.kernel.org/stable/c/4a4263dfeabad72f95e8ab6e15146861fa4144dd
• https://git.kernel.org/stable/c/b8f71d69380a5fbc734c868acbeb560f1de1766f
• https://git.kernel.org/stable/c/be550ee108ad80828aa61280400bedfc7e7c39d3

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel unix