CVE-2026-53033

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Take state lock for af_unix iter

When a BPF iterator program updates a sockmap, there is a race condition in

unix_stream_bpf_update_proto() where the `peer` pointer can become stale[1]

during a state transition TCP_ESTABLISHED -> TCP_CLOSE.

CPU0 bpf CPU1 close

-------- ----------

// unix_stream_bpf_update_proto()

sk_pair = unix_peer(sk)

if (unlikely(!sk_pair))

return -EINVAL;

// unix_release_sock()

skpair = unix_peer(sk);

unix_peer(sk) = NULL;

sock_put(skpair)

sock_hold(sk_pair) // UaF

More practically, this fix guarantees that the iterator program is

consistently provided with a unix socket that remains stable during

iterator execution.

[1]:

BUG: KASAN: slab-use-after-free in unix_strea

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References