Linux Kernel: af_unix UNIX_DIAG_VFS Read Race (CVE-2026-31673)
CVE-2026-31673 Published on April 25, 2026
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
In the Linux kernel, the following vulnerability has been resolved:
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Exact UNIX diag lookups hold a reference to the socket, but not to
u->path. Meanwhile, unix_release_sock() clears u->path under
unix_state_lock() and drops the path reference after unlocking.
Read the inode and device numbers for UNIX_DIAG_VFS while holding
unix_state_lock(), then emit the netlink attribute after dropping the
lock.
This keeps the VFS data stable while the reply is being built.
Products Associated with CVE-2026-31673
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 5f7b0569460b7d8d01ca776430a00505a68b7584 and below 0c739f3785f84af695952c2bac8be2f45082c9b8 is affected.
- Version 5f7b0569460b7d8d01ca776430a00505a68b7584 and below 900a4e0910e98b8caef117d5df00471fa438dcf9 is affected.
- Version 5f7b0569460b7d8d01ca776430a00505a68b7584 and below bdf206e740bf2919d818f132c8c9cc7ed91d11c0 is affected.
- Version 5f7b0569460b7d8d01ca776430a00505a68b7584 and below 39897df386376912d561d4946499379effa1e7ef is affected.
- Version 3.3 is affected.
- Before 3.3 is unaffected.
- Version 6.12.83, <= 6.12.* is unaffected.
- Version 6.18.24, <= 6.18.* is unaffected.
- Version 6.19.14, <= 6.19.* is unaffected.
- Version 7.0, <= * is unaffected.