CVE-2026-53292

What it actually does

This is a local denial-of-service flaw in the Linux kernel Phonet networking socket implementation. A user-triggerable send path can cause pn_socket_autobind() to call pn_socket_bind(), receive -EINVAL for a socket state condition, and incorrectly assume the socket was already bound. The subsequent BUG_ON() assertion can fire when the Phonet port is still zero, causing a kernel BUG and panic rather than returning a normal error to user space. Successful exploitation results in a system crash or reboot, not code execution or privilege escalation based on the available information.

Why it matters to the business

An attacker with the ability to run code locally on an affected Linux system may be able to crash the host, interrupting services, workloads, or user sessions running on it. The risk is most relevant for shared Linux systems, container hosts, multi-user servers, CI/build infrastructure, and environments where untrusted or semi-trusted users can execute programs. Public exploitation maturity is currently reported as none, EPSS is very low at 0.00107, and the issue is not listed in CISA KEV or ransomware-associated KEV data, so urgency is driven primarily by exposure to local untrusted users and service availability requirements rather than known active exploitation.

How an attack unfolds

An attacker first obtains local execution capability on an affected Linux system, such as a shell, compromised service account, scheduled job, or ability to run an untrusted binary. The attacker creates or manipulates a Phonet socket so that it reaches a state where pn_socket_bind() returns -EINVAL while the socket still has no assigned Phonet port. The attacker then invokes the send path, for example through sendto()/sendmsg(), causing pn_socket_sendmsg() to call pn_socket_autobind(). The vulnerable kernel path mishandles the -EINVAL return and reaches BUG_ON(!pn_port(...)), which triggers a kernel BUG. Depending on kernel panic/reboot settings, the host may panic, reboot, or become unavailable until manually recovered.

How to fix it

Apply a Linux kernel update from the operating system or appliance vendor that includes the upstream fix for the Phonet pn_socket_autobind() error-handling bug. No exact fixed package versions were provided in the input, so remediation should be tracked through the relevant vendor advisory, distribution security tracker, or stable kernel changelog for this CVE. Where immediate patching is not possible, reduce exposure by disabling or removing Phonet support if it is not required, for example by using a kernel build without CONFIG_PHONET where feasible, preventing the phonet module from loading if packaged as a module, and restricting local code execution by untrusted users. Standard hardening controls such as least-privilege accounts, container isolation, workload separation, and limiting shell access reduce practical exploitability but do not replace the kernel fix.

How to confirm the fix worked

Confirm that systems are running a vendor kernel version that includes the fix for this CVE. Review distribution package changelogs, kernel build metadata, and vendor security advisories rather than relying only on upstream version numbers because fixes may be backported. On systems where Phonet is not required, validate that Phonet support is unavailable or the phonet module cannot be loaded. Check kernel configuration for CONFIG_PHONET, loaded modules for phonet, and runtime availability of the Phonet socket family. After remediation, controlled regression testing should verify that malformed or invalid Phonet socket send operations return an ordinary errno rather than causing a kernel BUG, but such testing should only be performed in a non-production environment because vulnerable systems may crash.

Typical attack path

1. Gain local ability to execute code on an affected Linux host.
2. Create a Phonet socket using the vulnerable kernel networking subsystem.
3. Manipulate or use the socket so its state causes pn_socket_bind() to return -EINVAL before a Phonet port is assigned.
4. Call sendto() or sendmsg() on the socket, causing pn_socket_sendmsg() to invoke pn_socket_autobind().
5. Trigger the erroneous BUG_ON() assertion in net/phonet/socket.c.
6. Cause a kernel panic, crash, or reboot, resulting in denial of service.

How to detect it

Retrospective detection should focus on evidence of kernel crashes or panics with Phonet-specific stack traces. Review persistent kernel logs, system journal data, crash dumps, console logs, hypervisor out-of-band console captures, and reboot histories for BUG messages referencing net/phonet/socket.c, pn_socket_autobind(), or pn_socket_sendmsg(). On systemd-based hosts, query prior boots with journalctl -k -b -1 and related boot indexes for kernel BUG or panic entries. If kdump, apport, ABRT, sosreport, vmcore, or crash dump collection is enabled, inspect crash artifacts for instruction pointers or call traces in the Phonet socket path. Also correlate unexpected reboots, watchdog resets, or node disappearances with preceding kernel log entries. There are no known attacker tool names, network indicators, or file artifacts from the supplied information; exploitation is expected to be local and may leave only crash telemetry unless process accounting, auditd, or EDR captured the process invoking Phonet socket send operations immediately before the panic.

• kernel BUG at net/phonet/socket.c:213
• BUG_ON(!pn_port(pn_sk(sock->sk)->sobject))
• RIP: 0010:pn_socket_autobind
• RIP: 0010:pn_socket_sendmsg
• pn_socket_autobind net/phonet/socket.c:213
• pn_socket_sendmsg+0x240/0x250
• Call Trace:
• sock_sendmsg_nosec
• __sock_sendmsg
• __sys_sendto
• net/phonet/socket.c
• pn_socket_bind
• phonet

What your security team should do

• Prioritize patching shared, multi-user, container-hosting, CI/build, desktop, research, and other Linux systems where untrusted local code may execute.
• Track the applicable Linux distribution or vendor advisory and upgrade to the first kernel package that explicitly includes the fix for this CVE or the corresponding upstream Phonet patch.
• If Phonet is not operationally required, disable it at the kernel configuration or module-loading level as a compensating control.
• Review access controls for systems that permit local shell access, arbitrary job execution, or untrusted workloads, and reduce unnecessary local execution rights.
• Monitor for kernel panic, BUG, and reboot events containing Phonet call traces, especially pn_socket_autobind and pn_socket_sendmsg.
• Because EPSS is low, exploit maturity is reported as none, and the issue is not in KEV, handle through normal kernel vulnerability management unless local untrusted execution or high-availability requirements make denial of service especially impactful.