CVE-2026-64109

A flaw was found in the Linux kernel's af_unix (UNIX domain sockets) component. A race condition in the unix_stream_data_wait() function allows a local attacker to trigger a Use-After-Free (UAF) vulnerability. This occurs because the function peeks at a socket buffer without proper locking, enabling another thread to free the buffer while it is still being referenced. Successful exploitation of this UAF could lead to system instability or potentially information disclosure.

Use-after-free read in the AF_UNIX stream receive path can occur because unix_stream_data_wait reads the length of the tail SKB after observing the receive queue without a lock that protects against dequeue and free. A local process can trigger the race by using AF_UNIX stream sockets with peeking and normal receive operations on the same socket so that one thread waits on stale queue state while another thread removes and frees the SKB. For the CVSS the PR:L because attacker controlled local code is needed to create the socket state and race the recv operations, but no administrative privilege is required. The issue is not network reachable because AF_UNIX sockets are local IPC. Impact is at least local denial of service via kernel warning or crash, and in the paranoid score limited confidentiality or integrity impact is kept possible because this is a real UAF read of a freed kernel object, not just a pure logic hang.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.