CVE-2026-31673af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Updated under an hour ago ()
Does this affect you?
It affects Linux and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: af_unix: read UNIX_DIAG_VFS data under unix_state_lock Exact UNIX diag lookups hold a reference to the socket, but not to u->path. Meanwhile, unix_release_sock() clears u->path under unix_state_lock() and drops the path reference after unlocking. Read the inode and device numbers for UNIX_DIAG_VFS while holding unix_state_lock(), then emit the netlink attribute after dropping the lock. This keeps the VFS data stable while the reply is being built.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5f7b0569460b7d8d01ca776430a00505a68b7584 before e7339db13b9ddb63417b12da55fd6191e59f7442; 5f7b0569460b7d8d01ca776430a00505a68b7584 builds before 4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7; from 5f7b0569460b7d8d01ca776430a00505a68b7584 before c3ec44ab4526bbc4b6c9fc845af86488244f4c9b; from 5f7b0569460b7d8d01ca776430a00505a68b7584 before b9232421a77a649c9376c99fdfc8cb7f79cad34c; 5f7b0569460b7d8d01ca776430a00505a68b7584 builds before 0c739f3785f84af695952c2bac8be2f45082c9b8; from 5f7b0569460b7d8d01ca776430a00505a68b7584 before 900a4e0910e98b8caef117d5df00471fa438dcf9; from 5f7b0569460b7d8d01ca776430a00505a68b7584 before bdf206e740bf2919d818f132c8c9cc7ed91d11c0; from 5f7b0569460b7d8d01ca776430a00505a68b7584 before 39897df386376912d561d4946499379effa1e7ef | CNA record |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
linux linux_kernel linux:linux_kernel | from 3.3 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 7.0; 7.0; 7.0; 7.0; and 3 more ranges | NVD |
References
- https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442
- https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7
- https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b
- https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34cpatch
- https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8patch
- https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9patch
- https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0patch
- https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7efpatch
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.