Linux kernel sockmap: use-after-free of sk->sk_socket when an AF_UNIX peer is orphaned

Impact

unix_stream_sendmsg() calls the peer's ->sk_data_ready() after dropping unix_state_lock(). The sender holds a refcount on the peer socket but that does not stop the peer's sock_orphan(), so sk->sk_socket can be freed after an RCU grace period while sk_psock_verdict_data_ready() is still dereferencing it - a KASAN slab-use-after-free reported by syzbot on an ordinary sendmsg() path. Sockmap is not an exotic feature on these fleets: it is what BPF-based service mesh and socket-redirect datapaths use, so the code is live on nodes running Cilium-style networking. A use-after-free on a path driven by local unprivileged sendmsg() is a local privilege escalation candidate, and a KASAN-less production kernel will more often just panic the node.

Who can reach it

Local, unprivileged: any process that can create AF_UNIX stream sockets on a host where a sockmap/sk_psock verdict program is attached. The attacker needs no capability of their own - the sockmap attachment is supplied by the platform's own CNI or mesh.

What to do

Update the host kernel to a build carrying the stable fix commits below (fetching sk->sk_socket and its ops under RCU) and reboot each node. As an interim measure, detaching the sockmap verdict program removes the vulnerable path, but on a mesh or CNI datapath that is a connectivity change, not a free mitigation.

References

Related entries

• Linux kernel BPF verifier: regsafe() wrongly prunes states when old range is BEYOND_PKT_ENDCVE-2026-43030 · Linux kernel BPF verifier (regsafe() packet pointer range comparison)High
• Linux kernel authencesn: out-of-place decrypt writes high-order sequence bits into the destination bufferCVE-2026-43033 · Linux kernel crypto API (authencesn template, out-of-place decryption)High
• Linux kernel AF_ALG: af_alg_pull_tsgl can reassign one page past the end of the scatterlistCVE-2026-43078 · Linux kernel crypto API (af_alg_pull_tsgl page reassignment)High
• Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd): An out-of-bounds access in the amdkfd (KFD computeCVE-2026-43206 · Linux kernel amdkfd (KFD compute driver, /dev/kfd) (drm/amdkfd)High
• Linux kernel (drivers/pci): The PCI slot-lock failure path releases a lock the caller never took, which at best warnsCVE-2026-43211 · Linux kernel (drivers/pci)High
• KVM x86: __get_sregs2() reads PDPTRs without SRCU protection, dereferencing memslots unsafelyCVE-2026-43214 · Linux kernel KVM x86 (__get_sregs2 PDPTR read, missing SRCU protection)High