---
id: CVE-2026-31673
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  af_unix: read UNIX_DIAG_VFS data under unix_state_lock

  Exact UNIX diag lookups hold a reference to the socket, but not to
  u->path
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  af_unix: read UNIX_DIAG_VFS data under unix_state_lock

  Exact UNIX diag lookups hold a reference to the socket, but not to
  u->path. Meanwhile, unix_release_sock() clear…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 3.3, < 6.6.136'
  - 'linux_kernel >= 6.7, < 6.12.83'
  - 'linux_kernel >= 6.13, < 6.18.24'
  - 'linux_kernel >= 6.19, < 6.19.14'
  - linux_kernel = 7.0
patched:
  - linux_kernel 6.19.14
published: '2026-04-25'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T02:19:16.283'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-31673'
references:
  - url: 'https://git.kernel.org/stable/c/0c739f3785f84af695952c2bac8be2f45082c9b8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/39897df386376912d561d4946499379effa1e7ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4f6a8f10182c3a9d22e8eb183957ae7ade9e4bf7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/900a4e0910e98b8caef117d5df00471fa438dcf9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b9232421a77a649c9376c99fdfc8cb7f79cad34c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bdf206e740bf2919d818f132c8c9cc7ed91d11c0'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c3ec44ab4526bbc4b6c9fc845af86488244f4c9b'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e7339db13b9ddb63417b12da55fd6191e59f7442'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-784472.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00176
epssPercentile: 0.06636
ingestedAt: '2026-10-15T03:30:12.863Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

af_unix: read UNIX_DIAG_VFS data under unix_state_lock

Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path under
unix_state_lock() and drops the path reference after unlocking.

Read the inode and device numbers for UNIX_DIAG_VFS while holding
unix_state_lock(), then emit the netlink attribute after dropping the
lock.

This keeps the VFS data stable while the reply is being built.

## Affected

- `linux_kernel >= 3.3, < 6.6.136`
- `linux_kernel >= 6.7, < 6.12.83`
- `linux_kernel >= 6.13, < 6.18.24`
- `linux_kernel >= 6.19, < 6.19.14`
- `linux_kernel = 7.0`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.14`