{"id":"CVE-2026-64109","summary":"af_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Fix UAF read of tail-\u003elen in unix_stream_data_wait()\n\nunix_stream_data_wait() does skb_peek_tail(&sk-\u003esk_receive_queue) without\nholding any lock that prevents SKBs on that queue from being dequeued and\nfreed.\nThis has been the case since commit 79f632c71bea (\"unix/stream: fix\npeeking with an offset larger than data in queue\").\nThe first consequence of this is that the pointer comparison\n`tail != last` can be false even if `last` semantically refers to an\nalready-freed SKB while `tail` is a new SKB allocated at the same address;\nwhich can cause unix_stream_data_wait() to wrongly keep blocking after new\ndata has arrived, but only in a weird scenario where a peeking recv() and\na normal recv() on the same socket are racing, which is probably not a\nreal problem.\n\nBut since commit 2b514574f7e8 (\"net: af_unix: implement splice for stream\naf_unix sockets\"), `tail` is actually dereferenced, which can cause UAF in\nthe following race scenario (where test_setup() runs single-threaded,\nand afterwards, test_thread1() and test_thread2() run concurrently in\ntwo threads:\n```\nstatic int socks[2];\nvoid test_setup(void) {\n  socketpair(AF_UNIX, SOCK_STREAM, 0, socks);\n  send(socks[1], \"A\", 1, 0);\n  int peekoff = 1;\n  setsockopt(socks[0], SOL_SOCKET, SO_PEEK_OFF, &peekoff, sizeof(peekoff));\n}\nvoid test_thread1(void) {\n  char dummy;\n  recv(socks[0], &dummy, 1, MSG_PEEK);\n}\nvoid test_thread2(void) {\n  char dummy;\n  recv(socks[0], &dummy, 1, 0);\n  shutdown(socks[1], SHUT_WR);\n}\n```\n\nwhen racing like this:\n```\nthread1                       thread2\nunix_stream_read_generic\n  mutex_lock(&u-\u003eiolock)\n  skb_peek(&sk-\u003esk_receive_queue)\n  skb_peek_next(skb, &sk-\u003esk_receive_queue)\n  mutex_unlock(&u-\u003eiolock)\n                              unix_stream_read_generic\n                                unix_state_lock(sk)\n                                skb_peek(&sk-\u003esk_receive_queue)\n                                unix_state_unlock(sk)\n  unix_stream_data_wait\n    unix_state_lock(sk)\n    tail = skb_peek_tail(&sk-\u003esk_receive_queue)\n                                spin_lock(&sk-\u003esk_receive_queue.lock)\n                                __skb_unlink(skb, &sk-\u003esk_receive_queue)\n                                spin_unlock(&sk-\u003esk_receive_queue.lock)\n                                consume_skb(skb) [frees the SKB]\n    `tail != last`: false\n    `tail`: true\n    `tail-\u003elen != last_len` ***UAF***\n```\n\nFix the UAF by removing the read of tail-\u003elen; checking tail-\u003elen would\nonly make sense if SKBs in the receive queue of a UNIX socket could grow,\nwhich can no longer happen.\n\nKuniyuki explained:\n\n\u003e When commit 869e7c62486e (\"net: af_unix: implement stream sendpage\n\u003e support\") added sendpage() support, data could be appended to the last\n\u003e skb in the receiver's queue.\n\u003e\n\u003e That's why we needed to check if the length of the last skb was changed\n\u003e while waiting for new data in unix_stream_data_wait().\n\u003e\n\u003e However, commit a0dbf5f818f9 (\"af_unix: Support MSG_SPLICE_PAGES\") and\n\u003e commit 57d44a354a43 (\"unix: Convert unix_stream_sendpage() to use\n\u003e MSG_SPLICE_PAGES\") refactored sendmsg(), and now data is always added\n\u003e to a new skb.\n\nThat means this fix is not suitable for kernels before 6.5.","modified":"2026-07-22T05:29:57.107647344Z","published":"2026-07-19T15:40:11.510Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64109.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/26342087fac93b3932e6af61dc91ec029cb8a623"},{"type":"WEB","url":"https://git.kernel.org/stable/c/38bccb927d83d7d52e5b20015a172a0b6101d11e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5f162f95a95834f06a8ec6140889272ad12e842f"},{"type":"WEB","url":"https://git.kernel.org/stable/c/acdff9907478e82208475b1151700d0b71dcdc63"},{"type":"WEB","url":"https://git.kernel.org/stable/c/be309f8eae8b474a4a617eaae01324da996fc719"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64109.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64109"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"2b514574f7e88c8498027ee366fd6e7aae5aa4b5"},{"fixed":"26342087fac93b3932e6af61dc91ec029cb8a623"},{"fixed":"38bccb927d83d7d52e5b20015a172a0b6101d11e"},{"fixed":"acdff9907478e82208475b1151700d0b71dcdc63"},{"fixed":"5f162f95a95834f06a8ec6140889272ad12e842f"},{"fixed":"be309f8eae8b474a4a617eaae01324da996fc719"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64109.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.92"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64109.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}