CVE-2026-54778Medium· 6.2▾ SunlitCoreWCF: UnixDomainSocket Non-Reentrant POSIX Identity Resolution
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.1%
0.1% → 0.1%
Race condition in POSIX peer identity resolution may attribute one connection’s identity to another (getpwuid/getgrgid non-reentrant) and may crash the host process under contention.
Fixed in CoreWCF v1.8.1 and v1.9.1
Restrict UDS filesystem permissions so that only trusted local users can connect to the socket path. The race still exists but the attacker pool is constrained.
CoreWCF.UnixDomainSocket < 1.8.1CoreWCF.UnixDomainSocket >= 1.9.0, < 1.9.1Upgrade to a patched release:
CoreWCF.UnixDomainSocket 1.8.1CoreWCF.UnixDomainSocket 1.9.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-54776Medium· 4.4CoreWCF: Unix Domain Socket PosixIdentity transport accepts connections that skip the security upgrade
CVE-2026-43631High· 8.1llama.cpp builds b7492 through the latest b9060 contains a use-after-free vulnerability in the vocab pointer of llama-server when the --sleep-idle-seconds feature is enabled, allowing unauthenticated remote attackers to execute arbitrary…
CVE-2023-35823High· 7.0An issue was discovered in the Linux kernel before 6.3.2
CVE-2026-20617High· 7.0A race condition was addressed with improved state handling
CVE-2023-6531High· 7.0A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
CVE-2021-46925High· 7.8In the Linux kernel, the following vulnerability has been resolved: net/smc: fix kernel panic caused by race of smc_sock A crash occurs when smc_cdc_tx_handler() tries to access smc_sock but smc_release() has already freed it. [ 4570.…