CVE-2024-26750

What it actually does

Race condition in Linux kernel UNIX domain socket garbage collector (__unix_gc) allows a while loop processing oob_skb references to stall indefinitely when an oob_skb holds a self-referencing fd and another fd whose socket appears earlier in the candidate list, preventing kfree_skb from releasing remaining candidates and blocking __skb_queue_purge.

Why it matters to the business

Kernel worker threads can hang indefinitely, causing denial of service for any application or service that triggers UNIX socket garbage collection; widespread impact on systems running affected kernels until patched, with higher urgency for high-availability or multi-tenant environments.

How an attack unfolds

An attacker repeatedly creates UNIX domain sockets, passes file descriptors in a specific self-referential pattern via SCM_RIGHTS, and triggers garbage collection (via socket closure or memory pressure) so that the candidate ordering causes the GC loop to deadlock; no named threat actors are known to weaponize this specific flaw.

How to fix it

Upgrade linux packages to the fixed versions: Debian 11/12/13 to 5.10.28-1 or newer; Ubuntu linux-aws to 4.4.0-1102.107 or newer. Reboot after kernel upgrade. Apply vendor patches promptly given the 923 days since publication.

How to confirm the fix worked

Confirm kernel version reports a fixed release; run reproducer programs that previously triggered the hang (available in syzbot reports) and verify __unix_gc completes without task hang; monitor for absence of the NMI backtrace pattern involving __unix_gc.

Typical attack path

1. Create multiple AF_UNIX sockets and establish fd-passing relationships forming a cycle with oob_skb
2. Arrange socket order in the GC candidate list so a later self-referencing fd precedes an earlier one
3. Close sockets or induce memory pressure to enqueue __unix_gc work
4. Observe kernel worker thread hang in __unix_gc while loop

How to detect it

Search kernel logs and workqueue traces for repeated __unix_gc entries, NMI backtraces showing CPU stuck in __unix_gc, or kworker threads blocked on unix socket garbage collection; correlate with application logs showing sudden socket closure or fd-passing activity.

What your security team should do

• Prioritize kernel upgrades on all affected Debian and Ubuntu systems within the next maintenance window
• Test patched kernels in staging environments that exercise UNIX domain socket usage
• Monitor vendor advisories for any additional backports or CVEs in the same GC code path
• Restrict untrusted code execution on systems where immediate patching is delayed