Skip to content
Sign in
CVE-2026-805217.8High

CVE-2026-80521: af_unix: Unlink scc_entry in unix_del_edge().

Linux

Fixed in RHEL 10, Ubuntu 24.04/26.04, Debian 12/13, openSUSE Leap 16.0 · Affected: Linux · Exploitation: public proof of concept (unverified)

ExploitationProof of concept public

Not in CISA KEV as of catalogue 2026.11.10 (10 Nov)

  1. In CISA KEV: not seen
  2. Exploited (reported): not seen
  3. Scanning observed: not seen
  4. Proof of concept public2 public GitHub repositories (unverified), listed by PoC-in-GitHub16 Sep
  5. Not established: not seen
0.2%probability of exploitation in the next 30 days
7th percentile
050100

Higher than 7% of scored CVEs

7.8HighCVSS 3.1
LowHigh

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved: af_unix: Unlink scc_entry in unix_del_edge(). Kyle Zeng reported that GC could free a dead SCC partially. The scenario is as follows: 1) Create two SCCs: X -. A <-> B ^--' 2) Run the following concurrently: 2-1) send() sk-B to sk-B from sk-X 2-2) close() both A and B At 2-1), there is a small window where unix_add_edges() publishes a new edge (B <-> B) to GC but its skb is not queued by skb_queue_tail(). If 2-2) completes before skb_queue_tail() and GC is triggered, it judges A <-> B as dead, but B is not freed because GC cannot collect the not-yet-queued skb holding the B <-> B edge. X -. A <-> B -. This edge is visible ^--' ^..' but skb is not This itself is not a problem since the next GC run will judge B as dead as well and free it finally. X -. A <.> B -. ^--' ^--' However, X's SCC forces the next GC to call unix_walk_scc_fast(), and it iterates over A through B's scc_entry. Let's unlink scc_entry before freeing the vertex in unix_del_edge().

Fix status by distribution

From each distribution’s security tracker. Distributions we did not check are not listed.

What changed

Debian status tracked since 11 Nov 2026. Red Hat status tracked since 11 Nov 2026. SUSE status tracked since 11 Nov 2026. Ubuntu status tracked since 11 Nov 2026.

  1. Ubuntu published USN-9022-1 for Ubuntu 24.04 on 10 Nov (we saw it 11 Nov) Ubuntu
  2. PoC-in-GitHub lists 2 public GitHub repositories (unverified) PoC-in-GitHub

Coverage3 articles · 1 outlet

One row per outlet, in order of first report. First in our coverage: SecurityOnline, 28 Sep.

Full timeline
Developinglatest 16 hours ago3 articles1 outlet
28 Sep · SecurityOnline first23 Oct31 OctNow
  • Mon 28 Sep, 15:00 UTC. SecurityOnline, first report. Linux Kernel Flaw Lets Attackers Escape Containers and Run Code.
  • Sun 25 Oct, 11:01 UTC. SecurityOnline. OpenAI Paused AI Training After Model Broached Internet Defences.
  • Thu 12 Nov, 08:30 UTC. SecurityOnline. Google publishes Linux kernel exploit for privilege escalation.
All coveragerunning total3SecurityOnl…329 Sep15 Oct31 OctNow
  • First report
  • Article
  • Running total
Show as table
3 articles about CVE-2026-80521 from 1 outlets
Published (UTC)OutletHeadline
28 Sep 15:00SecurityOnlineLinux Kernel Flaw Lets Attackers Escape Containers and Run Code
25 Oct 11:01SecurityOnlineOpenAI Paused AI Training After Model Broached Internet Defences
12 Nov 08:30SecurityOnlineGoogle publishes Linux kernel exploit for privilege escalation
  1. Google publishes Linux kernel exploit for privilege escalation
    SecurityOnline
  2. OpenAI Paused AI Training After Model Broached Internet Defences
    SecurityOnline · mentions it in passing
  3. Linux Kernel Flaw Lets Attackers Escape Containers and Run Code
    SecurityOnline · first in our coverage

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in