SECUFOCUSNOW
Home›CVE index›CVE-2026-64109
Review reviewHigh

CVE-2026-64109

Linux

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even if `last` semantically refers to an already-freed SKB while `tail` is a new SKB allocated at the s...

CVSS
8.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix UAF read of tail->len in unix_stream_data_wait() unix_stream_data_wait() does skb_peek_tail(&sk->sk_receive_queue) without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since commit 79f632c71bea ("unix/stream: fix peeking with an offset larger than data in queue"). The first consequence of this is that the pointer comparison `tail != last` can be false even if `last` semantically refers to an already-freed SKB while `tail` is a new SKB allocated at the s...

Affected product and versions

Product
Linux
Affected versions
>= 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 < 26342087fac93b3932e6af61dc91ec029cb8a623, >= 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 < 38bccb927d83d7d52e5b20015a172a0b6101d11e, >= 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 < acdff9907478e82208475b1151700d0b71dcdc63, >= 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 < 5f162f95a95834f06a8ec6140889272ad12e842f, >= 2b514574f7e88c8498027ee366fd6e7aae5aa4b5 < be309f8eae8b474a4a617eaae01324da996fc719, >= 4.2
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CWE
Not available