Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-98394

af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer. Fahad Alharbi reported that recv(0, MSG_PEEK) triggers busy-wait in unix_stream_read_generic() if recv() is blocking and the last skb in the queue is MSG_OOB skb. In such a situation, TCP returns 0 immediately regardless of blocking or non-blocking. Let's follow the behaviour.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 314001f0bf927015e459c9d387d62a231fe93af3 to < 3d3c7a3df66b2ca3d2cd1a2a0c37eb701feba713affected
  • 314001f0bf927015e459c9d387d62a231fe93af3 to < d5dd55b316ca229a4cbf11729483ba5bb57233e7affected
  • 314001f0bf927015e459c9d387d62a231fe93af3 to < c81c5be3826c8467945b964d0cf7f7b3d65461dbaffected
  • 314001f0bf927015e459c9d387d62a231fe93af3 to < 6e5ee08eb5858d175da6768d75d163817b6a9d4aaffected

Linux Linux

Default version status: affected

  • 5.15affected
  • 0 to < 5.15unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References