LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26750: af_unix: Drop oob_skb ref before purging queue in GC.

In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop oob_skb ref before purging queue in GC. syzbot reported another task hung in __unix_gc(). [0] The current while loop assumes that all of the left candidates have oob_skb and calling kfree_skb(oob_skb) releases the remaining candidates. However, I missed a case that oob_skb has self-referencing fd and another fd and the latter sk is placed before the former in the candidate list. Then, the while loop never proceeds, resulting the task hung. __unix_gc() has the same loop just before purging the collected skb, so we can call kfree_skb(oob_skb) there and let __skb_queue_purge() release all inflight sockets. [0]: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2784 Comm: kworker/u4:8 Not tainted 6.8.0-rc4-syzkaller-01028-g71b605d32017 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: events_unbound __unix_gc RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:200 Code: 89 fb e8 23 00 00 00 48 8b 3d 84 f5 1a 0c 48 89 de 5b e9 43 26 57 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d 90 52 70 7e 65 8b 15 91 52 70 RSP: 0018:ffffc9000a17fa78 EFLAGS: 00000287 RAX: ffffffff8a0a6108 RBX: ffff88802b6c2640 RCX: ffff88802c0b3b80 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffc9000a17fbf0 R08: ffffffff89383f1d R09: 1ffff1100ee5ff84 R10: dffffc0000000000 R11: ffffed100ee5ff85 R12: 1ffff110056d84ee R13: ffffc9000a17fae0 R14: 0000000000000000 R15: ffffffff8f47b840 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffef5687ff8 CR3: 0000000029b34000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <TASK> __unix_gc+0xe69/0xf40 net/unix/garbage.c:343 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-26750 is a Linux kernel AF_UNIX garbage-collection bug that can make a kernel worker hang. The business impact is primarily availability risk, not confirmed data theft. The sources provide no CVSS score and no evidence of active exploitation.

Executive priority

Treat this as a normal-to-elevated Linux patching item. It affects kernel availability, but the public evidence does not show active exploitation, CVSS severity, or a vendor-specific emergency outside standard kernel update processes.

Technical view

The issue is in net/unix garbage collection. A self-referencing out-of-band skb file-descriptor case can keep __unix_gc() from progressing before queue purge. Linux resolved it by dropping the oob_skb reference before purging queued skbs.

Likely exposure

Exposure is limited to Linux systems running affected kernel builds before the relevant stable fixes. Containers inherit the host kernel, so containerized workloads may be affected through vulnerable hosts. Distribution backport status is not provided in the bundle.

Exploitation context

The report came from syzbot/syzkaller showing a hung __unix_gc() worker. The bundle marks KEV as false and cites no public in-the-wild exploitation or weaponized exploit.

Researcher notes

The source evidence supports a denial-of-service style hang in AF_UNIX GC logic. The affected-version data is sparse and commit-oriented, so distro package impact requires vendor mapping. Do not infer privilege requirements or exploitability beyond the provided syzbot report.

Mitigation direction

  • Apply Linux kernel or distribution updates containing the referenced stable fixes.
  • Check vendor advisories for backported fixes matching your deployed kernel packages.
  • Prioritize shared compute, container hosts, and high-availability Linux servers.
  • Schedule required reboots or live-patching according to vendor guidance.
  • Monitor kernel logs for hung tasks involving __unix_gc or AF_UNIX garbage collection.

Validation and detection

  • Inventory Linux kernel versions across servers, images, and container hosts.
  • Map each kernel package to distribution advisories or the listed stable commits.
  • Confirm patched kernels are booted, not only installed on disk.
  • Review monitoring for hung kworker tasks or __unix_gc stack traces.
  • Track remediation exceptions where vendor fix status is unclear.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26750 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux36f7371de977f805750748e80279be7e370df85c, 2a3d40b4025fcfe51b04924979f1653993b17669, 69e0f04460f4037e01e29f0d9675544f62aafca3, cb8890318dde26fc89c6ea67d6e9070ab50b6e91, 25236c91b5ab4a26a56ba2e79b8060cf4e047839unaffected
LinuxLinux5.15.149unaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.