CVE-2026-53034 — bpf, sockmap: Fix af_unix null-ptr-deref in proto update

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

bpf, sockmap: Fix af_unix null-ptr-deref in proto update

unix_stream_connect() sets sk_state (`WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED)`) _before_ it assigns a peer (`unix_peer(sk) = newsk`). sk_state == TCP_ESTABLISHED makes sock_map_sk_state_allowed() believe that socket is properly set up, which would include having a defined peer. IOW, there's a window when unix_stream_bpf_update_proto() can be called on socket which still has unix_peer(sk) == NULL.

CPU0 bpf CPU1 connect -------- ------------

WRITE_ONCE(sk->sk_state, TCP_ESTABLISHED) sock_map_sk_state_allowed(sk) ... sk_pair = unix_peer(sk) sock_hold(sk_pair) sock_hold(newsk) smp_mb__after_atomic() unix_peer(sk) = newsk

BUG: kernel NULL pointer dereference, address: 0000000000000080 RIP: 0010:unix_stream_bpf_update_proto+0xa0/0x1b0 Call Trace: sock_map_link+0x564/0x8b0 sock_map_update_common+0x6e/0x340 sock_map_update_elem_sys+0x17d/0x240 __sys_bpf+0x26db/0x3250 __x64_sys_bpf+0x21/0x30 do_syscall_64+0x6b/0x3a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Initial idea was to move peer assignment _before_ the sk_state update[1], but that involved an additional memory barrier, and changing the hot path was rejected. Then a NULL check during pro…

USN-8566-1 — linux, linux-gcp, linux-gke, linux-realtime vulnerabilities

Affected: Ubuntu:26.04:LTS: linux, Ubuntu:26.04:LTS: linux-gcp, Ubuntu:26.04:LTS: linux-gke, Ubuntu:26.04:LTS: linux-realtime

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PSP security protocol; - ARM64 architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - Intel NPU Driver; - DRBD Distributed Replicated Block Device drivers; - Ublk userspace block driver; - Bluetooth drivers; - Bus devices; - Character device driver; - Clock framework and drivers; - CPU frequency scaling framework; - Hardware crypto device drivers; - EDAC drivers; - EFI core; - FWCTL subsystem; - GPU drivers; - HID subsystem; - I3C subsystem; - InfiniBand drivers; - IOMMU subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - NVIDIA Tegra memory controller driver; - MTD block device drivers; - Network drivers; - Ethernet bonding driver; - Mellanox network drivers; - Microsoft Azure Network Adapter (MANA) driver; - STMicroelectronics network drivers; - MediaTek network drivers; - NVME drivers; - PCI subsystem;…

Most recent entries from all

CVE-2026-53034 — bpf, sockmap: Fix af_unix null-ptr-deref in proto update

USN-8566-1 — linux, linux-gcp, linux-gke, linux-realtime vulnerabilities