---
id: CVE-2026-80521
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  af_unix: Unlink scc_entry in unix_del_edge().

  Kyle Zeng reported that GC could free a dead SCC partially.

  The scenario is as follows:

     1) Create two SCCs:

         …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  af_unix: Unlink scc_entry in unix_del_edge().

  Kyle Zeng reported that GC could free a dead SCC partially.

  The scenario is as follows:

     1) Create two SCCs:

         …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4090fa373f0e763c43610853d2774b5979915959 <
    1293fd69a50d188a5788b08ba3741a3e86be1608
  - >-
    Linux >= 4090fa373f0e763c43610853d2774b5979915959 <
    fe198b077864feafd4aa4b33b1a5ce26f50195a2
  - >-
    Linux >= 4090fa373f0e763c43610853d2774b5979915959 <
    e3702470ced94fad74d71e2232f022d2eb752a6d
  - >-
    Linux >= 4090fa373f0e763c43610853d2774b5979915959 <
    594d905195024b228c962627ae5ae7c17bd582a4
  - Linux 5dfd283f4651d04dbb70ceb9ae5c4a30eda3c52a
  - Linux de7921631ff323369aa63a4324695ab54ea4047e
  - Linux >= 6.1.141 < 6.2
  - Linux >= 6.6.93 < 6.7
  - Linux 6.10
published: '2026-08-26'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:20.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80521'
references:
  - url: 'https://git.kernel.org/stable/c/1293fd69a50d188a5788b08ba3741a3e86be1608'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/594d905195024b228c962627ae5ae7c17bd582a4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e3702470ced94fad74d71e2232f022d2eb752a6d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fe198b077864feafd4aa4b33b1a5ce26f50195a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80521.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80521'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2524478'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80521'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80521'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026082601-CVE-2026-80521-2b35@gregkh/T
tags:
  - nvd
  - exploit-available
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00169
epssPercentile: 0.05554
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/Markakd/Container_escape'
  checkedAt: '2026-09-26T09:06:01.560Z'
exploitAvailable: true
ingestedAt: '2026-09-21T13:37:22.837Z'
cwe:
  - CWE-367
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Unlink scc_entry in unix_del_edge().

Kyle Zeng reported that GC could free a dead SCC partially.

The scenario is as follows:

   1) Create two SCCs:

       X -.   A <-> B
       ^--'

   2) Run the following concurrently:

      2-1) send() sk-B to sk-B from sk-X
      2-2) close() both A and B

At 2-1), there is a small window where unix_add_edges()
publishes a new edge (B <-> B) to GC but its skb is not queued
by skb_queue_tail().

If 2-2) completes before skb_queue_tail() and GC is triggered,
it judges A <-> B as dead, but B is not freed because GC cannot
collect the not-yet-queued skb holding the B <-> B edge.

       X -.   A <-> B -. This edge is visible
       ^--'         ^..'  but skb is not

This itself is not a problem since the next GC run will judge
B as dead as well and free it finally.

       X -.   A <.> B -.
       ^--'         ^--'

However, X's SCC forces the next GC to call unix_walk_scc_fast(),
and it iterates over A through B's scc_entry.

Let's unlink scc_entry before freeing the vertex in unix_del_edge().

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10 · no fix planned: Red Hat Enterprise Linux 10 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80521.json)