CVE-2026-22983

A NULL pointer dereference vulnerability was found in the Linux kernel's AF_UNIX socket implementation. In unix_stream_read_generic(), when splicing is used (state->msg is NULL), the code attempts to write to msg->msg_get_inq which dereferences the NULL pointer. This occurs because the callee incorrectly writes to msg_get_inq which is supposed to be an input-only field from caller to callee.

This vulnerability affects systems using AF_UNIX stream socket splicing functionality. The NULL dereference occurs during splice operations on Unix domain sockets when the msg structure is not provided. The issue was introduced when splice support was added for stream AF_UNIX sockets. Triggering requires local access to create and splice Unix sockets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.