{"id":"CVE-2024-26676","state":"PUBLISHED","title":"af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.","description":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.\n\nsyzbot reported a warning [0] in __unix_gc() with a repro, which\ncreates a socketpair and sends one socket's fd to itself using the\npeer.\n\n  socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0\n  sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=\"\\360\", iov_len=1}],\n          msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET,\n                                      cmsg_type=SCM_RIGHTS, cmsg_data=[3]}],\n          msg_controllen=24, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_ZEROCOPY) = 1\n\nThis forms a self-cyclic reference that GC should finally untangle\nbut does not due to lack of MSG_OOB handling, resulting in memory\nleak.\n\nRecently, commit 11498715f266 (\"af_unix: Remove io_uring code for\nGC.\") removed io_uring's dead code in GC and revealed the problem.\n\nThe code was executed at the final stage of GC and unconditionally\nmoved all GC candidates from gc_candidates to gc_inflight_list.\nThat papered over the reported problem by always making the following\nWARN_ON_ONCE(!list_empty(&gc_candidates)) false.\n\nThe problem has been there since commit 2aab4b969002 (\"af_unix: fix\nstruct pid leaks in OOB support\") added full scm support for MSG_OOB\nwhile fixing another bug.\n\nTo fix this problem, we must call kfree_skb() for unix_sk(sk)->oob_skb\nif the socket still exists in gc_candidates after purging collected skb.\n\nThen, we need to set NULL to oob_skb before calling kfree_skb() because\nit calls last fput() and triggers unix_release_sock(), where we call\nduplicate kfree_skb(u->oob_skb) if not NULL.\n\nNote that the leaked socket remained being linked to a global list, so\nkmemleak also could not detect it.  We need to check /proc/net/protocol\nto notice the unfreed socket.\n\n[0]:\nWARNING: CPU: 0 PID: 2863 at net/unix/garbage.c:345 __unix_gc+0xc74/0xe80 net/unix/garbage.c:345\nModules linked in:\nCPU: 0 PID: 2863 Comm: kworker/u4:11 Not tainted 6.8.0-rc1-syzkaller-00583-g1701940b1a02 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: events_unbound __unix_gc\nRIP: 0010:__unix_gc+0xc74/0xe80 net/unix/garbage.c:345\nCode: 8b 5c 24 50 e9 86 f8 ff ff e8 f8 e4 22 f8 31 d2 48 c7 c6 30 6a 69 89 4c 89 ef e8 97 ef ff ff e9 80 f9 ff ff e8 dd e4 22 f8 90 <0f> 0b 90 e9 7b fd ff ff 48 89 df e8 5c e7 7c f8 e9 d3 f8 ff ff e8\nRSP: 0018:ffffc9000b03fba0 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc9000b03fc10 RCX: ffffffff816c493e\nRDX: ffff88802c02d940 RSI: ffffffff896982f3 RDI: ffffc9000b03fb30\nRBP: ffffc9000b03fce0 R08: 0000000000000001 R09: fffff52001607f66\nR10: 0000000000000003 R11: 0000000000000002 R12: dffffc0000000000\nR13: ffffc9000b03fc10 R14: ffffc9000b03fc10 R15: 0000000000000001\nFS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005559c8677a60 CR3: 000000000d57a000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n process_one_work+0x889/0x15e0 kernel/workqueue.c:2633\n process_scheduled_works kernel/workqueue.c:2706 [inline]\n worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787\n kthread+0x2c6/0x3b0 kernel/kthread.c:388\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242\n </TASK>","publishedAt":"2024-04-02T07:01:40.758Z","updatedAt":"2026-05-23T15:36:37.870Z","severity":{"score":5.5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","source":"CISA-ADP"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f3969427fb06a2c3cd6efd7faab63505cfa76e76","status":"affected","lessThan":"4fe505c63aa3273135a57597fda761e9aecc7668","versionType":"git"},{"version":"ac1968ac399205fda9ee3b18f7de7416cb3a5d0d","status":"affected","lessThan":"e0e09186d8821ad59806115d347ea32efa43ca4b","versionType":"git"},{"version":"2aab4b96900272885bc157f8b236abf1cdc02e08","status":"affected","lessThan":"b74aa9ce13d02b7fd37c5325b99854f91b9b4276","versionType":"git"},{"version":"2aab4b96900272885bc157f8b236abf1cdc02e08","status":"affected","lessThan":"82ae47c5c3a6b27fdc0f9e83c1499cb439c56140","versionType":"git"},{"version":"2aab4b96900272885bc157f8b236abf1cdc02e08","status":"affected","lessThan":"1279f9d9dec2d7462823a18c29ad61359e0a007d","versionType":"git"},{"version":"a59d6306263c38e5c0592ea4451ca26a0778c947","status":"affected","versionType":"git"},{"version":"5.15.103","status":"affected","lessThan":"5.15.149","versionType":"semver"},{"version":"6.1.20","status":"affected","lessThan":"6.1.78","versionType":"semver"},{"version":"6.2.7","status":"affected","lessThan":"6.3","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/unix/garbage.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"5.15.149","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.78","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.17","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.5","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/unix/garbage.c"]}],"references":["https://git.kernel.org/stable/c/4fe505c63aa3273135a57597fda761e9aecc7668","https://git.kernel.org/stable/c/e0e09186d8821ad59806115d347ea32efa43ca4b","https://git.kernel.org/stable/c/b74aa9ce13d02b7fd37c5325b99854f91b9b4276","https://git.kernel.org/stable/c/82ae47c5c3a6b27fdc0f9e83c1499cb439c56140","https://git.kernel.org/stable/c/1279f9d9dec2d7462823a18c29ad61359e0a007d"],"weaknesses":["CWE-401"],"ingestedAt":"2026-10-29T20:07:10.607Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/26xxx/CVE-2024-26676.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-26676","state":"PUBLISHED","datePublished":"2024-04-02T07:01:40.758Z","dateUpdated":"2026-05-23T15:36:37.870Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2024-02-19T14:20:24.151Z"},"containers":{"cna":{"title":"af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.\n\nsyzbot reported a warning [0] in __unix_gc() with a repro, which\ncreates a socketpair and sends one socket's fd to itself using the\npeer.\n\n  socketpair(AF_UNIX, SOCK_STREAM, 0, [3, 4]) = 0\n  sendmsg(4, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base=\"\\360\", iov_len=1}],\n          msg_iovlen=1, msg_control=[{cmsg_len=20, cmsg_level=SOL_SOCKET,\n                                      cmsg_type=SCM_RIGHTS, cmsg_data=[3]}],\n          msg_controllen=24, msg_flags=0}, MSG_OOB|MSG_PROBE|MSG_DONTWAIT|MSG_ZEROCOPY) = 1\n\nThis forms a self-cyclic reference that GC should finally untangle\nbut does not due to lack of MSG_OOB handling, resulting in memory\nleak.\n\nRecently, commit 11498715f266 (\"af_unix: Remove io_uring code for\nGC.\") removed io_uring's dead code in GC and revealed the problem.\n\nThe code was executed at the final stage of GC and unconditionally\nmoved all GC candidates from gc_candidates to gc_inflight_list.\nThat papered over the reported problem by always making the following\nWARN_ON_ONCE(!list_empty(&gc_candidates)) false.\n\nThe problem has been there since commit 2aab4b969002 (\"af_unix: fix\nstruct pid leaks in OOB support\") added full scm support for MSG_OOB\nwhile fixing another bug.\n\nTo fix this problem, we must call kfree_skb() for unix_sk(sk)->oob_skb\nif the socket still exists in gc_candidates after purging collected skb.\n\nThen, we need to set NULL to oob_skb before calling kfree_skb() because\nit calls last fput() and triggers unix_release_sock(), where we call\nduplicate kfree_skb(u->oob_skb) if not NULL.\n\nNote that the leaked socket remained being linked to a global list, so\nkmemleak also could not detect it.  We need to check /proc/net/protocol\nto notice the unfreed socket.\n\n[0]:\nWARNING: CPU: 0 PID: 2863 at net/unix/garbage.c:345 __unix_gc+0xc74/0xe80 net/unix/garbage.c:345\nModules linked in:\nCPU: 0 PID: 2863 Comm: kworker/u4:11 Not tainted 6.8.0-rc1-syzkaller-00583-g1701940b1a02 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\nWorkqueue: events_unbound __unix_gc\nRIP: 0010:__unix_gc+0xc74/0xe80 net/unix/garbage.c:345\nCode: 8b 5c 24 50 e9 86 f8 ff ff e8 f8 e4 22 f8 31 d2 48 c7 c6 30 6a 69 89 4c 89 ef e8 97 ef ff ff e9 80 f9 ff ff e8 dd e4 22 f8 90 <0f> 0b 90 e9 7b fd ff ff 48 89 df e8 5c e7 7c f8 e9 d3 f8 ff ff e8\nRSP: 0018:ffffc9000b03fba0 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffc9000b03fc10 RCX: ffffffff816c493e\nRDX: ffff88802c02d940 RSI: ffffffff896982f3 RDI: ffffc9000b03fb30\nRBP: ffffc9000b03fce0 R08: 0000000000000001 R09: fffff52001607f66\nR10: 0000000000000003 R11: 0000000000000002 R12: dffffc0000000000\nR13: ffffc9000b03fc10 R14: ffffc9000b03fc10 R15: 0000000000000001\nFS:  0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005559c8677a60 CR3: 000000000d57a000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n <TASK>\n process_one_work+0x889/0x15e0 kernel/workqueue.c:2633\n process_scheduled_works kernel/workqueue.c:2706 [inline]\n worker_thread+0x8b9/0x12a0 kernel/workqueue.c:2787\n kthread+0x2c6/0x3b0 kernel/kthread.c:388\n ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242\n </TASK>"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"f3969427fb06a2c3cd6efd7faab63505cfa76e76","status":"affected","lessThan":"4fe505c63aa3273135a57597fda761e9aecc7668","versionType":"git"},{"version":"ac1968ac399205fda9ee3b18f7de7416cb3a5d0d","status":"affected","lessThan":"e0e09186d8821ad59806115d347ea32efa43ca4b","versionType":"git"},{"version":"2aab4b96900272885bc157f8b236abf1cdc02e08","status":"affected","lessThan":"b74aa9ce13d02b7fd37c5325b99854f91b9b4276","versionType":"git"},{"version":"2aab4b96900272885bc157f8b236abf1cdc02e08","status":"affected","lessThan":"82ae47c5c3a6b27fdc0f9e83c1499cb439c56140","versionType":"git"},{"version":"2aab4b96900272885bc157f8b236abf1cdc02e08","status":"affected","lessThan":"1279f9d9dec2d7462823a18c29ad61359e0a007d","versionType":"git"},{"version":"a59d6306263c38e5c0592ea4451ca26a0778c947","status":"affected","versionType":"git"},{"version":"5.15.103","status":"affected","lessThan":"5.15.149","versionType":"semver"},{"version":"6.1.20","status":"affected","lessThan":"6.1.78","versionType":"semver"},{"version":"6.2.7","status":"affected","lessThan":"6.3","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/unix/garbage.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"5.15.149","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.78","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.17","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.7.5","status":"unaffected","lessThanOrEqual":"6.7.*","versionType":"semver"},{"version":"6.8","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/unix/garbage.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/4fe505c63aa3273135a57597fda761e9aecc7668"},{"url":"https://git.kernel.org/stable/c/e0e09186d8821ad59806115d347ea32efa43ca4b"},{"url":"https://git.kernel.org/stable/c/b74aa9ce13d02b7fd37c5325b99854f91b9b4276"},{"url":"https://git.kernel.org/stable/c/82ae47c5c3a6b27fdc0f9e83c1499cb439c56140"},{"url":"https://git.kernel.org/stable/c/1279f9d9dec2d7462823a18c29ad61359e0a007d"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T15:36:37.870Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.103","versionEndExcluding":"5.15.149"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.20","versionEndExcluding":"6.1.78"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.17"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.7.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2.7"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":5.5,"attackVector":"LOCAL","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2025-05-07T20:00:56.944715Z","id":"CVE-2024-26676","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-401","type":"CWE","lang":"en","description":"CWE-401 Missing Release of Memory after Effective Lifetime"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-07T20:01:37.103Z"}},{"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/4fe505c63aa3273135a57597fda761e9aecc7668","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/e0e09186d8821ad59806115d347ea32efa43ca4b","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/b74aa9ce13d02b7fd37c5325b99854f91b9b4276","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/82ae47c5c3a6b27fdc0f9e83c1499cb439c56140","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/1279f9d9dec2d7462823a18c29ad61359e0a007d","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T00:14:12.513Z"}}]}}}