{"id":"CVE-2026-80521","title":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n   1) Create two SCCs:\n\n       …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n   1) Create two SCCs:\n\n       …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 4090fa373f0e763c43610853d2774b5979915959 < 1293fd69a50d188a5788b08ba3741a3e86be1608","Linux >= 4090fa373f0e763c43610853d2774b5979915959 < fe198b077864feafd4aa4b33b1a5ce26f50195a2","Linux >= 4090fa373f0e763c43610853d2774b5979915959 < e3702470ced94fad74d71e2232f022d2eb752a6d","Linux >= 4090fa373f0e763c43610853d2774b5979915959 < 594d905195024b228c962627ae5ae7c17bd582a4","Linux 5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a","Linux de7921631ff323369aa63a4324695ab54ea4047e","Linux >= 6.1.141 < 6.2","Linux >= 6.6.93 < 6.7","Linux 6.10"],"published":"2026-08-26","updated":"2026-09-21","sourceUpdated":"2026-09-21T14:17:20.193","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-80521","references":[{"url":"https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80521.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-80521"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2524478"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80521"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80521"},{"url":"https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80521-2b35@gregkh/T"}],"tags":["nvd","exploit-available","cve.org","csaf","vex","red-hat"],"epss":0.00169,"epssPercentile":0.05618,"exploits":{"github":1,"githubRepos":["https://github.com/Markakd/Container_escape"],"checkedAt":"2026-09-27T10:34:01.625Z"},"exploitAvailable":true,"ingestedAt":"2026-09-21T13:37:22.837Z","cwe":["CWE-367"],"slug":"CVE-2026-80521","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\naf_unix: Unlink scc_entry in unix_del_edge().\n\nKyle Zeng reported that GC could free a dead SCC partially.\n\nThe scenario is as follows:\n\n   1) Create two SCCs:\n\n       X -.   A <-> B\n       ^--'\n\n   2) Run the following concurrently:\n\n      2-1) send() sk-B to sk-B from sk-X\n      2-2) close() both A and B\n\nAt 2-1), there is a small window where unix_add_edges()\npublishes a new edge (B <-> B) to GC but its skb is not queued\nby skb_queue_tail().\n\nIf 2-2) completes before skb_queue_tail() and GC is triggered,\nit judges A <-> B as dead, but B is not freed because GC cannot\ncollect the not-yet-queued skb holding the B <-> B edge.\n\n       X -.   A <-> B -. This edge is visible\n       ^--'         ^..'  but skb is not\n\nThis itself is not a problem since the next GC run will judge\nB as dead as well and free it finally.\n\n       X -.   A <.> B -.\n       ^--'         ^--'\n\nHowever, X's SCC forces the next GC to call unix_walk_scc_fast(),\nand it iterates over A through B's scc_entry.\n\nLet's unlink scc_entry before freeing the vertex in unix_del_edge().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80521.json)","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}