Cloudanix VulnDB

CVE-2026-98289

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can cause certain internal socket connections to be cleaned up incorrectly, potentially wasting memory over time on affected systems.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Logic error in Tarjan SCC finalization within __unix_walk_scc() fails to unify scc_index across all vertices when multiple back edges exist, causing unix_vertex_dead() to misclassify vertices and skip garbage collection of Unix domain socket references.

Why it matters to the business

Systems may experience gradual kernel memory exhaustion or resource leaks under workloads that create complex Unix socket graphs, increasing operational risk of denial of service on servers or containers that rely heavily on AF_UNIX sockets; low exploitation probability and no known campaigns reduce immediate urgency.

How an attack unfolds

An attacker constructs a directed graph of Unix sockets containing an SCC with at least two back edges, triggers DFS traversal in the order that produces inconsistent lowpoint values, and relies on the resulting failure to reclaim socket vertices to induce a leak; no named threat actors or public exploits are associated with this issue.

How to fix it

Apply the upstream fix that moves scc_index unification into __unix_walk_scc() and removes the 'fast' argument; rebuild and deploy an updated kernel image containing commit bfdb01283ee8 plus the subsequent unification change.

How to confirm the fix worked

Confirm the corrected __unix_walk_scc() implementation unifies scc_index for every vertex in the SCC before returning; run kernel selftests for af_unix and verify that graphs with multiple back edges are fully garbage-collected.

Typical attack path

  1. Establish multiple AF_UNIX sockets forming a strongly connected component with redundant back edges
  2. Force a specific DFS visit order through socket creation and connection sequencing
  3. Trigger garbage collection via socket closure or process termination
  4. Observe that vertices with mismatched scc_index values are not reclaimed

How to detect it

Inspect kernel memory statistics and slab usage for af_unix objects after socket-intensive workloads; correlate with process termination events that should have triggered collection; no public exploit artifacts are known.

What your security team should do

  • Prioritize kernel updates on systems with high AF_UNIX socket usage within the next maintenance window
  • Monitor EPSS and KEV status for any future increase in exploit maturity
  • Review container runtime and service configurations that create many local sockets for potential leak amplification

The record

In the Linux kernel, the following vulnerability has been resolved: af_unix: Unify scc_index when finalising SCC in __unix_walk_scc(). Commit bfdb01283ee8 ("af_unix: Assign a unique index to SCC.") changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint (unix_vertex.scc_index). unix_vertex_dead() assumes all vertices in an SCC share the same lowpoint, but this is not always true if an SCC has two or more back edges, depending on the order of DFS. For example, the graph below has two back edges from B to A and from C to B. A --> B --> C ^ | ^ | `----' `----' If DFS walks through A -> B -> C -> B (-> C -> B) -> A (-> B -> A), each index and scc_index will be updated as follows. A --> B --> C C = (3, 3) (index, scc_index) B = (2, 2) A = (1, 1) A ... B ... C C = (3, 2)<-. ^ | B = (2, 2) -' `----' A = (1, 1) A ... B ... C C = (3, 2) ^ | . . B = (2, 1)<-. `----' .... A = (1, 1) -' Then, unix_vertex_dead() thinks that B is passed to another SCC with scc_index 2, and the SCC is not garbage-collected. This does not happen if DFS walks in a different order below or starts from B. 1 3 A --> B --> C ^ | ^ | `----' `----' 2 4 Let's unify scc_index across the SCC when finalising it. Note that updating v->index was previously done in unix_scc_dead(), when called from __unix_walk_scc(), just to save one loop. Since __unix_walk_scc() now iterates over the SCC anyway, the update is moved back to __unix_walk_scc() and 'fast' argument is dropped.

Affected packages

Ecosystem Package Introduced Fixed